Defining IAM Policies with Terraform in AWS

[Music] welcome to cloudera note plus your source for exclusive videos and online events for aws professionals my name is andreas and today we are writing some telephone code together i want to demonstrate three different ways to specify an iron policy with terraform and you know specifying iron policies is what we have to do when creating any aws infrastructure so that's definitely an important topic let's have a look at the source code so this is my main tf5 my main terraform file and what i've prepared so far is i've configured the provider terraform and i've also defined an s3 bucket so because that is what i will reference in my i am policies so let's assume we now need to create an iron policy to grant for example an iron roll access to list all the objects in the bucket and also to get and write data to the bucket so that's our goal so how can we achieve that so first of all the first way i did create iron policies with terraform is this so i'm creating an i am policy resource um i've just named it inline for here and then i defined the policy here inline so this is basically the syntax that you can just insert any data in this case json into the parameter here so that is how i've been doing it for quite some time so what we need to add here is we need s3 list bucket effect allow is fine um maybe we should have it in here and then we need to reference the resource so then this is aws s3 bucket example.rn so this is referencing the amazon resource name of the bucket and we need to copy that and then we do get object to read data and the put object to write data to the bucket and important here the resource iron changes so this references all the objects in the bucket okay so this is one way to define an iron policy so let me quickly apply that terraform apply so let's quickly go through that let's see if that's actually works or if i have any issues in my um policy and it creates the inline policy and that worked fine okay so that's one way to define an ion policy what i promised you three different options so the next one so what is the problem with this so i would say first of all it doesn't look it doesn't look very well right so you have json terraform language all mixed together it's a little bit clumsy also your indention breaks a little bit so yeah not not too nice to have a look at i promised you three options here is the second one so and the second one uses json encode so this is a built-in terraform function that you can use and basically it translates the terraform syntax to a json string later i think that is quite helpful because you don't need to specify that string you can specify the json in here so this is cool it feels feels more natural i would say so what we have is version statement already in here effect allow and now we need our actions so let's do that let me um create a list here and the thing is i need the aws three bucket example arn in here and ah sorry no i need the uh sorry s3 list bucket and then we have resource and here we have the thing we have the list um come on we have the list of the the resources which is the bucket okay and now i need to copy that because we do not only need that we also have the get object action as well as the put object action so let's add this here and then we need the resource in the format and that includes the um the object keys or the object aren't better to say and so now this is the policy that creates the same this is the resource in terraform that creates the same ion policy than we have before but instead of having that json string in line we have more more of a terraform syntax in here which i like um basically a lot so let's do terraform apply one more time just to make sure that this policy gets created correctly um so let's see what's going on so create a new policy and yeah that worked as well okay so now we have two two policies identically but with different terraform syntax okay so let's discuss the third option which i basically prefer and i will show you why in a second the third option uses a data resource which is called aws iom policy document and so this is not a resource that actually gets created in your account it's just a data structure within terraform you know i might know that from other things and what you can do is we can define iron policies within that um policy document so that's really a cool thing and we need also a resource the iron policy resource and basically what happens here is um the policy here references the data structure so data aws ironpolicydocument.example.json and basically this will render the chase and then put it in to this policy attribute so that's how it works um i've pre-populated that a little bit so um the difference here is as you can see we are not just doing a json encode but we have really a dedicated resource in terraform for an impolicy document which i find quite interesting so again the list bucket is the action and we have the resources that we need to specify in here so let's do that and the resource is again the aws s3 bucket example.arm so that's that's one thing that's the one statement that we need and then i just copy the statement we can add multiple statements here so we have uh also get object and um put object and the um the resource um is then pointing to the needs to point as well to the um object iron so let's do that okay so now we have basically the same so it doesn't look too different to what i showed you with the json encode example and basically the result is also the same so let's quickly do that let me do another terraform apply um this will just create a third iron policy with the identical exam policy at the end um so let's do that and um what's the benefit of all of that so the iron policy document compared to the json encode approach it looks very similar it's also terraform syntax and but what's the thing here is let me introduce two typos to this main tf file so let's say i don't know we have statement without the t and that's within the policy document resource and let me do this let me do that and what i do know is terraform validate and terraform validate says oh this is not correct statement is nothing i know about so this this is not correct you need to fix that so i'm to statement and now this works again so that's cool so if i do the same thing in my json encode example i can also remove the t here the problem is terraform does not know it doesn't check it doesn't validate that thing it's just a json structure so basically the cool thing about the data i'm policy document thing is that terraform is now able to validate the policy that you specify at least from a structural perspective and that avoids failures before you apply or even whereas you go through a pipeline and stuff so that's why i really like this way to define iron policies in terraform so yeah so this is really cool so you will find all the example code in the show notes so you can check it out and copy it from there i highly recommend to use this third option um whenever you have to define iron policies within your terraform code you can reach out to us and the community about this topic or any other aws related topic visit dot community.cloudant.io and ask your question we are looking forward to hear from you thanks for watching don't forget to rate this video if you learned something new and also your feedback is very important to us to be able to produce relevant videos for you so reach out to out to us via email twitter the community and let us know what you think about this video we are back in one week thanks a lot for your support bye

Channel: cloudonaut

Views: 1,089

Keywords: aws, amazon web service, cloudonaut, cloud, cloudcomputing, cloud computing, terraform, aws terraform, iam policy, iam policies, terraform aim, iam policy in terraform, aws cloud, aws tutorial, aws training, aws tutorial for beginners, amazon aws tutorial, defining iam policies with terraform, how to define iam policy in terraform, terraform iam policy, aws terraform iam role policy, aws terraform iam, aws iam role policy, iam role policy terraform, aim policy in aws terraform

Id: cI9yoJ0qV8Q

Length: 10min 46sec (646 seconds)

Published: Sun Aug 22 2021