feat: Use inline instead of managed policies #615

RafaelWO · 2024-08-29T11:51:13Z

Description

This PR replaces customer-managed policies with inline policies becuase the policies are only used for the Lambda function. See also Managed policies and inline policies.

Motivation and Context

Fixes #607

Breaking Changes

If users have attached the customer-managed policies to other resources, this change is breaking (in theory) since the new policies will be inline. But it is very unlikely that users did this.

How Has This Been Tested?

I have updated at least one of the examples/* to demonstrate and validate my change(s)
I have tested and validated these changes using one or more of the provided examples/* projects

I have tested this branch against on of my projects using this module. Below is the terraform plan output

Expand

Terraform will perform the following actions:

  # module.lambda_function.aws_iam_policy.additional_jsons[0] will be destroyed
  # (because aws_iam_policy.additional_jsons is not in configuration)
  - resource "aws_iam_policy" "additional_jsons" {
      - arn         = "arn:aws:iam::123456789012:policy/foo-bar-dev-0" -> null
      - id          = "arn:aws:iam::123456789012:policy/foo-bar-dev-0" -> null
      - name        = "foo-bar-dev-0" -> null
      - path        = "/" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = "s3:ListBucket"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::mybucket-dev"
                      - Sid      = "ListObjectsInBucket"
                    },
                  - {
                      - Action   = "s3:PutObject"
                      - Effect   = "Allow"
                      - Resource = "arn:aws:s3:::mybucket-dev/*"
                      - Sid      = "WriteOnly"
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id   = "asdfasdfa" -> null
      - tags        = {} -> null
      - tags_all    = {
          - "Environment" = "dev"
          - "Owner"       = "Terraform"
        } -> null
        # (2 unchanged attributes hidden)
    }

  # module.lambda_function.aws_iam_policy.logs[0] will be destroyed
  # (because aws_iam_policy.logs is not in configuration)
  - resource "aws_iam_policy" "logs" {
      - arn         = "arn:aws:iam::123456789012:policy/foo-bar-dev-logs" -> null
      - id          = "arn:aws:iam::123456789012:policy/foo-bar-dev-logs" -> null
      - name        = "foo-bar-dev-logs" -> null
      - path        = "/" -> null
      - policy      = jsonencode(
            {
              - Statement = [
                  - {
                      - Action   = [
                          - "logs:PutLogEvents",
                          - "logs:CreateLogStream",
                          - "logs:CreateLogGroup",
                        ]
                      - Effect   = "Allow"
                      - Resource = [
                          - "arn:aws:logs:eu-west-1:123456789012:log-group:/aws/lambda/foo-bar-dev:*:*",
                          - "arn:aws:logs:eu-west-1:123456789012:log-group:/aws/lambda/foo-bar-dev:*",
                        ]
                    },
                ]
              - Version   = "2012-10-17"
            }
        ) -> null
      - policy_id   = "asdfasdf" -> null
      - tags        = {} -> null
      - tags_all    = {
          - "Environment" = "dev"
          - "Owner"       = "Terraform"
        } -> null
        # (2 unchanged attributes hidden)
    }

  # module.lambda_function.aws_iam_role_policy.additional_jsons[0] will be created
  + resource "aws_iam_role_policy" "additional_jsons" {
      + id          = (known after apply)
      + name        = "foo-bar-dev-0"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = "s3:ListBucket"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::mybucket-dev"
                      + Sid      = "ListObjectsInBucket"
                    },
                  + {
                      + Action   = "s3:PutObject"
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::mybucket-dev/*"
                      + Sid      = "WriteOnly"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = "foo-bar-dev"
    }

  # module.lambda_function.aws_iam_role_policy.logs[0] will be created
  + resource "aws_iam_role_policy" "logs" {
      + id          = (known after apply)
      + name        = "foo-bar-dev-logs"
      + name_prefix = (known after apply)
      + policy      = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "logs:PutLogEvents",
                          + "logs:CreateLogStream",
                          + "logs:CreateLogGroup",
                        ]
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:logs:eu-west-1:123456789012:log-group:/aws/lambda/foo-bar-dev:*:*",
                          + "arn:aws:logs:eu-west-1:123456789012:log-group:/aws/lambda/foo-bar-dev:*",
                        ]
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + role        = "foo-bar-dev"
    }

  # module.lambda_function.aws_iam_role_policy_attachment.additional_jsons[0] will be destroyed
  # (because aws_iam_role_policy_attachment.additional_jsons is not in configuration)
  - resource "aws_iam_role_policy_attachment" "additional_jsons" {
      - id         = "foo-bar-dev-20240826142417847400000001" -> null
      - policy_arn = "arn:aws:iam::123456789012:policy/foo-bar-dev-0" -> null
      - role       = "foo-bar-dev" -> null
    }

  # module.lambda_function.aws_iam_role_policy_attachment.logs[0] will be destroyed
  # (because aws_iam_role_policy_attachment.logs is not in configuration)
  - resource "aws_iam_role_policy_attachment" "logs" {
      - id         = "foo-bar-dev-20240826142417916300000003" -> null
      - policy_arn = "arn:aws:iam::123456789012:policy/foo-bar-dev-logs" -> null
      - role       = "foo-bar-dev" -> null
    }

Plan: 2 to add, 0 to change, 4 to destroy.

I have executed pre-commit run -a on my pull request

antonbabenko

From the first look at this PR, it looks pretty good, but why are only some policy attachments changed? Should we update vpc, tracing, etc also?

RafaelWO · 2024-08-30T08:50:54Z

From the first look at this PR, it looks pretty good, but why are only some policy attachments changed? Should we update vpc, tracing, etc also?

Happy to change those as well but I was not sure because it looks like it they are copied from AWS-managed policies:

Copying AWS managed policy to be able to attach the same policy with multiple roles without overwrites by another function

Apparently, there was an issue with only creating an aws_iam_role_policy_attachment with the AWS-managed policy ARN (see #26). Or is this obsolete?

RafaelWO · 2024-09-02T15:32:54Z

Should we update vpc, tracing, etc also?

@antonbabenko, or did you mean using the policy from the "copy" data block in a aws_iam_role_policy? I.e. changing

# Copying AWS managed policy to be able to attach the same policy with multiple roles without overwrites by another function
data "aws_iam_policy" "vpc" {
  count = local.create_role && var.attach_network_policy ? 1 : 0
  arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
}

resource "aws_iam_policy" "vpc" {
  count = local.create_role && var.attach_network_policy ? 1 : 0
  name   = "${local.policy_name}-vpc"
  path   = var.policy_path
  policy = data.aws_iam_policy.vpc[0].policy
  tags   = var.tags
}

resource "aws_iam_role_policy_attachment" "vpc" {
  count = local.create_role && var.attach_network_policy ? 1 : 0
  role       = aws_iam_role.lambda[0].name
  policy_arn = aws_iam_policy.vpc[0].arn
}

to

# Copying AWS managed policy to be able to attach the same policy with multiple roles without overwrites by another function
data "aws_iam_policy" "vpc" {
  count = local.create_role && var.attach_network_policy ? 1 : 0
  arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaENIManagementAccess"
}

resource "aws_iam_role_policy" "vpc" {
  count = local.create_role && var.attach_network_policy ? 1 : 0
  name   = "${local.policy_name}-vpc"
  role   = aws_iam_role.lambda[0].name
  policy = data.aws_iam_policy.vpc[0].policy
}

github-actions · 2024-10-03T00:21:24Z

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

RafaelWO · 2024-10-04T11:43:59Z

Should we update vpc, tracing, etc also?

@antonbabenko, I updated vpc and tracing as well (as described in my comment above) 🙂

I don't think there is anything left, or is there?

github-actions · 2024-11-07T00:21:26Z

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

RafaelWO · 2024-11-07T07:18:32Z

@antonbabenko Looking forward to your review 🙂

github-actions · 2024-12-08T00:26:01Z

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

RafaelWO · 2024-12-10T14:01:04Z

@antonbabenko ping 🙂

hossamdash · 2024-12-24T18:20:20Z

would be great if this gets merged!

nitrocode · 2025-01-04T14:51:43Z

main.tf

-    aws_iam_role_policy_attachment.logs,
-    aws_iam_role_policy_attachment.dead_letter,
-    aws_iam_role_policy_attachment.vpc,
-    aws_iam_role_policy_attachment.tracing,


Should the lambda now require a depends_on for each of the new aws_iam_role_policy?

I think, yes. Do you agree, @RafaelWO ? If so, please fix it, and I will merge it very quickly.

Sounds good! I fixed it 🙂

antonbabenko

Minor correction is missing. I have already reviewed other dependencies and potential issues. Looks great! Sorry that it took so long for me to review it!

antonbabenko · 2025-01-07T23:15:05Z

main.tf

-    aws_iam_role_policy_attachment.logs,
-    aws_iam_role_policy_attachment.dead_letter,
-    aws_iam_role_policy_attachment.vpc,
-    aws_iam_role_policy_attachment.tracing,


I think, yes. Do you agree, @RafaelWO ? If so, please fix it, and I will merge it very quickly.

* Remove unused variable `policy_path`

RafaelWO · 2025-01-08T06:46:19Z

I guess I somehow messed up the PR by rebasing after the master was merged into my branch 😬

~~Should I open a new clean PR with my changes?~~ NVM: I fixed it.

@antonbabenko do you want to merge master into this one before merging?

## [7.20.0](v7.19.0...v7.20.0) (2025-01-08) ### Features * Use inline instead of managed policies ([#615](#615)) ([394d337](394d337))

antonbabenko · 2025-01-08T20:44:26Z

This PR is included in version 7.20.0 🎉

antonbabenko · 2025-01-08T20:48:57Z

@RafaelWO Thank you a lot for this contribution!

RafaelWO · 2025-01-08T21:01:21Z

It was a pleasure 😊

RafaelWO changed the title ~~Use inline instead of managed policies~~ refactor: Use inline instead of managed policies Aug 29, 2024

RafaelWO changed the title ~~refactor: Use inline instead of managed policies~~ chore: Use inline instead of managed policies Aug 29, 2024

RafaelWO force-pushed the change/use-inline-policies branch from d042c7d to f86cdf4 Compare August 29, 2024 12:01

RafaelWO marked this pull request as ready for review August 29, 2024 13:27

RafaelWO changed the title ~~chore: Use inline instead of managed policies~~ feat: Use inline instead of managed policies Aug 29, 2024

antonbabenko reviewed Aug 29, 2024

View reviewed changes

github-actions bot added the stale label Oct 3, 2024

RafaelWO force-pushed the change/use-inline-policies branch from f86cdf4 to a1d27a7 Compare October 4, 2024 11:42

RafaelWO force-pushed the change/use-inline-policies branch from a1d27a7 to 42a3fb6 Compare October 4, 2024 12:33

github-actions bot removed the stale label Oct 5, 2024

RafaelWO force-pushed the change/use-inline-policies branch from 42a3fb6 to d2f44e8 Compare October 7, 2024 07:23

github-actions bot added the stale label Nov 7, 2024

github-actions bot removed the stale label Nov 8, 2024

github-actions bot added the stale label Dec 8, 2024

github-actions bot removed the stale label Dec 11, 2024

nitrocode requested a review from antonbabenko January 4, 2025 14:48

nitrocode reviewed Jan 4, 2025

View reviewed changes

antonbabenko requested changes Jan 7, 2025

View reviewed changes

♻️ Use inline instead of managed policies

ec01bf8

* Remove unused variable `policy_path`

RafaelWO force-pushed the change/use-inline-policies branch from 06845fe to 5fcc934 Compare January 8, 2025 06:42

RafaelWO force-pushed the change/use-inline-policies branch from 5fcc934 to ec01bf8 Compare January 8, 2025 06:48

Merge branch 'master' into change/use-inline-policies

40c75c5

antonbabenko approved these changes Jan 8, 2025

View reviewed changes

Try to deprecate variable policy_path correctly

393f260

antonbabenko merged commit 394d337 into terraform-aws-modules:master Jan 8, 2025
30 checks passed

antonbabenko pushed a commit that referenced this pull request Jan 8, 2025

chore(release): version 7.20.0 [skip ci]

de6ae34

## [7.20.0](v7.19.0...v7.20.0) (2025-01-08) ### Features * Use inline instead of managed policies ([#615](#615)) ([394d337](394d337))

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Use inline instead of managed policies #615

feat: Use inline instead of managed policies #615

RafaelWO commented Aug 29, 2024 •

edited

Loading

antonbabenko left a comment

RafaelWO commented Aug 30, 2024

RafaelWO commented Sep 2, 2024

github-actions bot commented Oct 3, 2024

RafaelWO commented Oct 4, 2024 •

edited

Loading

github-actions bot commented Nov 7, 2024

RafaelWO commented Nov 7, 2024

github-actions bot commented Dec 8, 2024

RafaelWO commented Dec 10, 2024

hossamdash commented Dec 24, 2024

nitrocode Jan 4, 2025

antonbabenko Jan 7, 2025

RafaelWO Jan 8, 2025

antonbabenko left a comment

antonbabenko Jan 7, 2025

RafaelWO commented Jan 8, 2025 •

edited

Loading

antonbabenko commented Jan 8, 2025

antonbabenko commented Jan 8, 2025

RafaelWO commented Jan 8, 2025

feat: Use inline instead of managed policies #615

feat: Use inline instead of managed policies #615

Conversation

RafaelWO commented Aug 29, 2024 • edited Loading

Description

Motivation and Context

Breaking Changes

How Has This Been Tested?

antonbabenko left a comment

Choose a reason for hiding this comment

RafaelWO commented Aug 30, 2024

RafaelWO commented Sep 2, 2024

github-actions bot commented Oct 3, 2024

RafaelWO commented Oct 4, 2024 • edited Loading

github-actions bot commented Nov 7, 2024

RafaelWO commented Nov 7, 2024

github-actions bot commented Dec 8, 2024

RafaelWO commented Dec 10, 2024

hossamdash commented Dec 24, 2024

nitrocode Jan 4, 2025

Choose a reason for hiding this comment

antonbabenko Jan 7, 2025

Choose a reason for hiding this comment

RafaelWO Jan 8, 2025

Choose a reason for hiding this comment

antonbabenko left a comment

Choose a reason for hiding this comment

antonbabenko Jan 7, 2025

Choose a reason for hiding this comment

RafaelWO commented Jan 8, 2025 • edited Loading

antonbabenko commented Jan 8, 2025

antonbabenko commented Jan 8, 2025

RafaelWO commented Jan 8, 2025

RafaelWO commented Aug 29, 2024 •

edited

Loading

RafaelWO commented Oct 4, 2024 •

edited

Loading

RafaelWO commented Jan 8, 2025 •

edited

Loading