aws_iam_policy_document logical resource

builtin/providers/aws/iam_policy_model.go

@@ -0,0 +1,74 @@
+package aws
+
+import (
+ "encoding/json"
+)
+
+type IAMPolicyDoc struct {
+ Id string `json:",omitempty"`
+ Version string `json:",omitempty"`
+ Statements []*IAMPolicyStatement `json:"Statement"`
+}
+
+type IAMPolicyStatement struct {
+ Sid string `json:",omitempty"`
+ Effect string `json:",omitempty"`
+ Actions []string `json:"Action,omitempty"`
+ NotActions []string `json:"NotAction,omitempty"`
+ Resources []string `json:"Resource,omitempty"`
+ NotResources []string `json:"NotResource,omitempty"`
+ Principals IAMPolicyStatementPrincipalSet `json:"Principal,omitempty"`
+ NotPrincipals IAMPolicyStatementPrincipalSet `json:"NotPrincipal,omitempty"`
+ Conditions IAMPolicyStatementConditionSet `json:"Condition,omitempty"`
+}
+
+type IAMPolicyStatementPrincipal struct {
+ Type string
+ Identifiers []string
+}
+
+type IAMPolicyStatementCondition struct {
+ Test string
+ Variable string
+ Values []string
+}
+
+type IAMPolicyStatementPrincipalSet []IAMPolicyStatementPrincipal
+type IAMPolicyStatementConditionSet []IAMPolicyStatementCondition
+
+func (ps IAMPolicyStatementPrincipalSet) MarshalJSON() ([]byte, error) {
+ raw := map[string][]string{}
+
+ for _, p := range ps {
+ if _, ok := raw[p.Type]; !ok {
+ raw[p.Type] = make([]string, 0, len(p.Identifiers))
+ }
+ raw[p.Type] = append(raw[p.Type], p.Identifiers...)
+ }
+
+ return json.Marshal(&raw)
+}
+
+func (cs IAMPolicyStatementConditionSet) MarshalJSON() ([]byte, error) {
+ raw := map[string]map[string][]string{}
+
+ for _, c := range cs {
+ if _, ok := raw[c.Test]; !ok {
+ raw[c.Test] = map[string][]string{}
+ }
+ if _, ok := raw[c.Test][c.Variable]; !ok {
+ raw[c.Test][c.Variable] = make([]string, 0, len(c.Values))
+ }
+ raw[c.Test][c.Variable] = append(raw[c.Test][c.Variable], c.Values...)
+ }
+
+ return json.Marshal(&raw)
+}
+
+func iamPolicyDecodeConfigStringList(lI []interface{}) []string {
+ ret := make([]string, len(lI))
+ for i, vI := range lI {
+ ret[i] = vI.(string)
+ }
+ return ret
+}

builtin/providers/aws/provider.go

@@ -176,6 +176,7 @@ func Provider() terraform.ResourceProvider {
  "aws_iam_instance_profile": resourceAwsIamInstanceProfile(),
  "aws_iam_policy": resourceAwsIamPolicy(),
  "aws_iam_policy_attachment": resourceAwsIamPolicyAttachment(),
+ "aws_iam_policy_document": resourceAwsIamPolicyDocument(),
  "aws_iam_role_policy": resourceAwsIamRolePolicy(),
  "aws_iam_role": resourceAwsIamRole(),
  "aws_iam_saml_provider": resourceAwsIamSamlProvider(),

builtin/providers/aws/resource_aws_iam_policy_document.go

@@ -0,0 +1,225 @@
+package aws
+
+import (
+ "encoding/json"
+ "strings"
+
+ "github.com/hashicorp/terraform/helper/schema"
+)
+
+var resourceAwsIamPolicyDocumentVarReplacer = strings.NewReplacer("&{", "${")
+
+func resourceAwsIamPolicyDocument() *schema.Resource {
+ setOfString := &schema.Schema{
+ Type: schema.TypeSet,
+ Optional: true,
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ }
+
+ return &schema.Resource{
+ Create: resourceAwsIamPolicyDocumentUpdate,
+ Read: resourceAwsIamPolicyDocumentNoop,
+ Update: resourceAwsIamPolicyDocumentUpdate,
+ Delete: resourceAwsIamPolicyDocumentDelete,
+
+ Schema: map[string]*schema.Schema{
+ "id": &schema.Schema{
+ Type: schema.TypeString,
+ Optional: true,
+ },
+ "statement": &schema.Schema{
+ Type: schema.TypeSet,
+ Required: true,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "id": &schema.Schema{
+ Type: schema.TypeString,
+ Optional: true,
+ },
+ "effect": &schema.Schema{
+ Type: schema.TypeString,
+ Optional: true,
+ Default: "Allow",
+ },
+ "actions": setOfString,
+ "not_actions": setOfString,
+ "resources": setOfString,
+ "not_resources": setOfString,
+ "principals": resourceAwsIamPolicyPrincipalSchema(),
+ "not_principals": resourceAwsIamPolicyPrincipalSchema(),
+ "condition": &schema.Schema{
+ Type: schema.TypeSet,
+ Optional: true,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "test": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ },
+ "variable": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ },
+ "values": &schema.Schema{
+ Type: schema.TypeSet,
+ Required: true,
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ },
+ "json": &schema.Schema{
+ Type: schema.TypeString,
+ Computed: true,
+ },
+ },
+ }
+}
+
+func resourceAwsIamPolicyDocumentUpdate(d *schema.ResourceData, meta interface{}) error {
+
+ doc := &IAMPolicyDoc{
+ Version: "2012-10-17",
+ }
+
+ id := d.Get("id").(string)
+ if id != "" {
+ doc.Id = id
+ }
+
+ var cfgStmts = d.Get("statement").(*schema.Set).List()
+ stmts := make([]*IAMPolicyStatement, len(cfgStmts))
+ doc.Statements = stmts
+ for i, stmtI := range cfgStmts {
+ cfgStmt := stmtI.(map[string]interface{})
+ stmt := &IAMPolicyStatement{
+ Effect: cfgStmt["effect"].(string),
+ }
+
+ if actions := cfgStmt["actions"].(*schema.Set).List(); len(actions) > 0 {
+ stmt.Actions = iamPolicyDecodeConfigStringList(actions)
+ }
+ if actions := cfgStmt["not_actions"].(*schema.Set).List(); len(actions) > 0 {
+ stmt.NotActions = iamPolicyDecodeConfigStringList(actions)
+ }
+
+ if resources := cfgStmt["resources"].(*schema.Set).List(); len(resources) > 0 {
+ stmt.Resources = resourceAwsIamPolicyDocumentReplaceVarsInList(
+ iamPolicyDecodeConfigStringList(resources),
+ )
+ }
+ if resources := cfgStmt["not_resources"].(*schema.Set).List(); len(resources) > 0 {
+ stmt.NotResources = resourceAwsIamPolicyDocumentReplaceVarsInList(
+ iamPolicyDecodeConfigStringList(resources),
+ )
+ }
+
+ if principals := cfgStmt["principals"].(*schema.Set).List(); len(principals) > 0 {
+ stmt.Principals = resourceAwsIamPolicyDocumentMakePrincipals(principals)
+ }
+
+ if principals := cfgStmt["not_principals"].(*schema.Set).List(); len(principals) > 0 {
+ stmt.NotPrincipals = resourceAwsIamPolicyDocumentMakePrincipals(principals)
+ }
+
+ if conditions := cfgStmt["condition"].(*schema.Set).List(); len(conditions) > 0 {
+ stmt.Conditions = resourceAwsIamPolicyDocumentMakeConditions(conditions)
+ }
+
+ stmts[i] = stmt
+ }
+
+ jsonDoc, err := json.MarshalIndent(doc, "", " ")
+ if err != nil {
+ // should never happen if the above code is correct
+ return err
+ }
+
+ d.Set("json", string(jsonDoc))
+ if id != "" {
+ d.SetId(id)
+ } else {
+ d.SetId("anon")
+ }
+
+ return nil
+}
+
+func resourceAwsIamPolicyDocumentReplaceVarsInList(in []string) []string {
+ out := make([]string, len(in))
+ for i, item := range in {
+ out[i] = resourceAwsIamPolicyDocumentVarReplacer.Replace(item)
+ }
+ return out
+}
+
+func resourceAwsIamPolicyDocumentMakeConditions(in []interface{}) IAMPolicyStatementConditionSet {
+ out := make([]IAMPolicyStatementCondition, len(in))
+ for i, itemI := range in {
+ item := itemI.(map[string]interface{})
+ out[i] = IAMPolicyStatementCondition{
+ Test: item["test"].(string),
+ Variable: item["variable"].(string),
+ Values: resourceAwsIamPolicyDocumentReplaceVarsInList(
+ iamPolicyDecodeConfigStringList(
+ item["values"].(*schema.Set).List(),
+ ),
+ ),
+ }
+ }
+ return IAMPolicyStatementConditionSet(out)
+}
+
+func resourceAwsIamPolicyDocumentMakePrincipals(in []interface{}) IAMPolicyStatementPrincipalSet {
+ out := make([]IAMPolicyStatementPrincipal, len(in))
+ for i, itemI := range in {
+ item := itemI.(map[string]interface{})
+ out[i] = IAMPolicyStatementPrincipal{
+ Type: item["type"].(string),
+ Identifiers: resourceAwsIamPolicyDocumentReplaceVarsInList(
+ iamPolicyDecodeConfigStringList(
+ item["identifiers"].(*schema.Set).List(),
+ ),
+ ),
+ }
+ }
+ return IAMPolicyStatementPrincipalSet(out)
+}
+
+func resourceAwsIamPolicyDocumentDelete(d *schema.ResourceData, meta interface{}) error {
+ d.SetId("")
+ return nil
+}
+
+func resourceAwsIamPolicyDocumentNoop(d *schema.ResourceData, meta interface{}) error {
+ return nil
+}
+
+func resourceAwsIamPolicyPrincipalSchema() *schema.Schema {
+ return &schema.Schema{
+ Type: schema.TypeSet,
+ Optional: true,
+ Elem: &schema.Resource{
+ Schema: map[string]*schema.Schema{
+ "type": &schema.Schema{
+ Type: schema.TypeString,
+ Required: true,
+ },
+ "identifiers": &schema.Schema{
+ Type: schema.TypeSet,
+ Required: true,
+ Elem: &schema.Schema{
+ Type: schema.TypeString,
+ },
+ },
+ },
+ },
+ }
+}