data_source/aws_iam_policy_document: Make statement optional

[YakDriver]

Fixes part 1 of #5047

Changes proposed in this pull request:

• Make statement optional
• Make appropriate documentation changes
• Add 2 acceptance tests
• Change a few variable names in data_source/aws_iam_policy_document to Go convention

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccAWSDataSourceIAMPolicyDocument_'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./... -v -run=TestAccAWSDataSourceIAMPolicyDocument_ -timeout 120m
?   	github.com/terraform-providers/terraform-provider-aws	[no test files]
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_basic
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_basic (9.90s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_source
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_source (12.31s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_sourceConflicting
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_sourceConflicting (9.68s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_override
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_override (7.83s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_noStatementMerge
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_noStatementMerge (8.09s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_noStatementOverride
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_noStatementOverride (10.13s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	57.969s

[YakDriver]

With this PR, the following is possible:

data "aws_iam_policy_document" "source" {
  statement {
    sid = "OverridePlaceholder"
    actions   = ["ec2:DescribeAccountAttributes"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "override" {
  statement {
    sid = "OverridePlaceholder"
    actions   = ["s3:GetObject"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "yak_politik" {
  source_json = "${data.aws_iam_policy_document.source.json}"
  override_json = "${data.aws_iam_policy_document.override.json}"
}

The data source aws_iam_policy_document.yak_politik.json would be invalid currently but with this PR would evaluate as:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "OverridePlaceholder",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "*"
    }
  ]
}

[tvald]

This is definitely helpful for #5047!

[YakDriver]

@tvald Thanks for the input! I'm not currently working on part 2 of #5047 but wanted to get your thoughts on the design approach to part 2: a new data source (perhaps aws_iam_policy_list) with 1 main attribute (perhaps policy_json_list) and possibly a policy_id attribute. The list of policies would just be merged in order so those coming later would override earlier. The list, of course, could include aws_iam_policy_document data sources.

[tvald]

Replied back in #5047 to keep the broader discussion in one place.

[bflad]

This looks great and its very awesome to enhance policy layering -- thanks so much, @YakDriver! 🚀

--- PASS: TestAccAWSDataSourceIAMPolicyDocument_override (4.10s)
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_sourceConflicting (4.15s)
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_noStatementOverride (4.20s)
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_noStatementMerge (4.44s)
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_basic (4.56s)
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_source (5.95s)

[YakDriver]

Nice! 👍

[bflad]

This has been released in version 1.40.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!