Attach AWS Managed Policies to Terraform Roles

• Introduction
• Step-by-Step Guide
• Code Example
• Additional Notes
• Summary
• Conclusion
• References

When working with AWS Identity and Access Management (IAM) in Terraform, attaching managed policies to IAM roles is a fundamental task. This article explores two primary methods to achieve this, outlining their use cases, advantages, and potential pitfalls to help you make informed decisions for your infrastructure as code.

There are two primary ways to attach AWS managed policies to IAM roles in Terraform, each with its own use cases and considerations:

Method 1: Using managed_policy_arns within aws_iam_role

This method is the most straightforward and recommended approach for most scenarios. You directly specify the ARNs of the managed policies you want to attach within the aws_iam_role resource itself.

Steps:

1. Identify the ARNs of the managed policies: You can find these in the IAM console or using the AWS CLI/SDK. For example, the ARN for the "AmazonS3FullAccess" policy is arn:aws:iam::aws:policy/AmazonS3FullAccess.

2. Modify your Terraform code:

   resource "aws_iam_role" "example" {
     name = "example-role"
     assume_role_policy = jsonencode({
       Version = "2012-10-17"
       Statement = [
         {
           Action = "sts:AssumeRole"
           Principal = {
             Service = "ec2.amazonaws.com"
           }
           Effect = "Allow"
           Sid    = ""
         },
       ]
     })
   
     # Attach managed policies
     managed_policy_arns = [
       "arn:aws:iam::aws:policy/AmazonS3FullAccess",
       "arn:aws:iam::aws:policy/CloudWatchFullAccess"
     ]
   }

   In this example, we're creating an IAM role named "example-role" and attaching two managed policies: "AmazonS3FullAccess" and "CloudWatchFullAccess".

Method 2: Using aws_iam_role_policy_attachment

This method offers more granular control and is useful when you need to manage policy attachments separately from the role definition itself. However, it's essential to understand its limitations, particularly when dealing with multiple attachments to the same policy.

Steps:

1. Define the IAM role: Start by defining your IAM role using the aws_iam_role resource as usual.

2. Attach policies using aws_iam_role_policy_attachment:

   resource "aws_iam_role" "example" {
     # ... role definition ...
   }
   
   resource "aws_iam_role_policy_attachment" "s3_attachment" {
     role       = aws_iam_role.example.name
     policy_arn = "arn:aws:iam::aws:policy/AmazonS3FullAccess"
   }
   
   resource "aws_iam_role_policy_attachment" "cloudwatch_attachment" {
     role       = aws_iam_role.example.name
     policy_arn = "arn:aws:iam::aws:policy/CloudWatchFullAccess"
   }

   Here, we're attaching the same policies as in Method 1, but using separate aws_iam_role_policy_attachment resources.

Important Considerations:

• Resource Conflicts: Using both managed_policy_arns and aws_iam_role_policy_attachment for the same role and policy can lead to conflicts. Terraform might try to manage the attachment in two places, causing unexpected behavior. Choose one method and stick with it for consistency.

• Terraform Drift: If you manually attach or detach policies outside of Terraform, it can lead to configuration drift. Ensure that all policy attachments are managed within your Terraform code to maintain consistency.

• Modularity and Reusability: While aws_iam_role_policy_attachment offers more granular control, using managed_policy_arns within aws_iam_role often leads to more concise and reusable code, especially when dealing with multiple roles that require the same set of policies.

By understanding these methods and considerations, you can effectively manage AWS managed policy attachments to your IAM roles in Terraform. Choose the approach that best suits your specific needs and project structure.

This JavaScript code demonstrates how to create IAM roles and attach managed policies using AWS CDK. It showcases two methods: attaching policies directly during role creation and adding policies separately using dedicated methods. The code imports necessary modules, defines a CDK stack, creates roles with specified permissions, and outlines the deployment process using AWS CDK CLI.

While the provided examples are in Terraform's HashiCorp Configuration Language (HCL), you can't directly execute Terraform code within JavaScript. Terraform uses its own CLI and interacts with cloud providers through APIs.

However, you can achieve similar infrastructure provisioning using JavaScript with tools like AWS CDK (Cloud Development Kit). The CDK allows you to define cloud resources using familiar programming languages like JavaScript.

Here's how you can translate the provided Terraform examples into JavaScript using AWS CDK:

const { App, Stack } = require('aws-cdk-lib');
const { Role, ServicePrincipal, ManagedPolicy, PolicyStatement } = require('aws-cdk-lib/aws-iam');

class MyStack extends Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    // Method 1: Attaching policies directly to the role
    const roleWithInlinePolicies = new Role(this, 'ExampleRoleWithInlinePolicies', {
      assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        ManagedPolicy.fromAwsManagedPolicyName('AmazonS3FullAccess'),
        ManagedPolicy.fromAwsManagedPolicyName('CloudWatchFullAccess'),
      ],
    });

    // Method 2: Using separate policy attachments
    const roleWithSeparateAttachments = new Role(this, 'ExampleRoleWithSeparateAttachments', {
      assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
    });

    roleWithSeparateAttachments.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AmazonS3FullAccess'));
    roleWithSeparateAttachments.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('CloudWatchFullAccess'));
  }
}

const app = new App();
new MyStack(app, 'MyStack');
app.synth();

Explanation:

1. Import necessary modules: We import required classes from aws-cdk-lib and aws-cdk-lib/aws-iam.
2. Define a CDK stack: We create a class MyStack extending cdk.Stack to define our infrastructure.
3. Method 1:
   • We create an IAM role (roleWithInlinePolicies) using new Role.
   • We specify assumedBy to define who can assume this role (EC2 in this case).
   • We use managedPolicies to directly attach AWS managed policies by their names using ManagedPolicy.fromAwsManagedPolicyName.
4. Method 2:
   • We create another role (roleWithSeparateAttachments).
   • We attach policies separately using roleWithSeparateAttachments.addManagedPolicy.

To deploy this CDK code:

1. Make sure you have AWS CDK installed (npm install -g aws-cdk).
2. Bootstrap your AWS environment for CDK if you haven't already (cdk bootstrap).
3. Run cdk deploy within the directory of your CDK code.

Remember that CDK provides a higher-level abstraction over cloud resources compared to Terraform. While the concepts are similar, the syntax and tools used are different.

General Best Practices:

• Principle of Least Privilege: Always strive to grant only the necessary permissions. Avoid attaching overly permissive policies like AmazonS3FullAccess unless absolutely required. Consider using more granular policies or creating custom policies tailored to your specific needs.
• Policy Versioning: Be aware that AWS managed policies can be updated by AWS. While this usually involves security enhancements or new features, it's crucial to test your infrastructure after such updates to ensure compatibility and avoid unexpected behavior.
• Naming Conventions: Use descriptive and consistent naming conventions for your IAM roles and policy attachments. This improves readability and maintainability of your Terraform code.

Method 1 (managed_policy_arns):

• Simplicity and Readability: This method shines when you have a standard set of policies to apply to multiple roles. It keeps the role definition concise and easy to understand.
• Ideal for Static Policy Sets: If your policy requirements are relatively stable and don't change frequently, this method is generally preferred.

Method 2 (aws_iam_role_policy_attachment):

• Dynamic Policy Management: This method is beneficial when you need to dynamically attach or detach policies based on conditions or variables within your Terraform code.
• Granular Control: It allows for more fine-grained management of individual policy attachments, which can be helpful in complex scenarios.
• Potential for Conflicts: Exercise caution when using this method, especially if you're also using managed_policy_arns for the same role and policy. Ensure you have a clear understanding of how Terraform handles these situations to avoid conflicts.

Additional Tips:

• Terraform Modules: For enhanced code organization and reusability, consider encapsulating your IAM role and policy logic within Terraform modules. This promotes modularity and makes it easier to manage IAM resources across multiple projects or environments.
• Policy Simulation: Before deploying changes to production, utilize IAM policy simulators (available in the AWS console or CLI) to test and validate the effective permissions granted by your IAM roles and attached policies. This helps prevent accidental privilege escalation or access issues.
• Infrastructure as Code Best Practices: Adhere to general IaC best practices like using version control, automated testing, and proper documentation to ensure the reliability and maintainability of your Terraform codebase.

This document summarizes two methods for attaching AWS managed policies to IAM roles using Terraform:

Important Considerations:

• Resource Conflicts: Avoid using both methods for the same role and policy to prevent unexpected behavior.
• Terraform Drift: Manage all policy attachments within Terraform to maintain consistency and avoid drift.
• Modularity and Reusability: managed_policy_arns often leads to more concise and reusable code, especially when multiple roles require the same policies.

Choose the method that best suits your needs based on complexity, control requirements, and desired code structure.

In conclusion, managing AWS managed policy attachments to IAM roles in Terraform can be accomplished through two primary methods: using managed_policy_arns within the aws_iam_role resource or employing the aws_iam_role_policy_attachment resource. The former offers simplicity and is suitable for most scenarios, while the latter provides granular control over policy attachments. It's crucial to avoid using both methods for the same role and policy to prevent conflicts. Regardless of the chosen method, adhering to best practices such as the principle of least privilege, policy versioning, and consistent naming conventions is essential for maintaining a secure and well-managed AWS environment. By understanding the nuances of each method and following these recommendations, you can effectively manage IAM policy attachments, ensuring your infrastructure as code remains robust and scalable.

• Attach Amazon managed policy to our existing policy : r/Terraform | Posted by u/Oxffff0000 - 7 votes and 17 comments
• aws_iam_policy_attachment | Resources | hashicorp/aws | Terraform | ... role's managed policy attachments and Terraform will show a permanent difference. NOTE: To ensure Terraform correctly manages dependencies during updates ...
• Terraform gets confused by multiple policy attachments for same ... | We're trying to modularize some code setting policies for a number of roles across multiple environments. In some environments the policies are the same for multiple roles. Terraform will quite hap...
• aws_iam_role_policy_attachment | hashicorp/aws | Terraform | Resource: aws_iam_role_policy_attachment. Attaches a Managed IAM Policy to an IAM role. NOTE: The usage of this resource conflicts with the ...
• destroying aws_iam_policy_attachment to a managed policy deletes ... | If you use the "aws_iam_policy_attachment" resource to attach a role to a managed_policy, when you destroy the configuration, it will remove attachments made by other configurations, or even manual...
• How to Create AWS IAM Role with Terraform [Step-by-Step] | In this step-by-step tutorial, you'll learn how to create an AWS IAM Role using Terraform with AWS Terraform provider. See an example.
• Terraform attaching existing managed policy to a new role · GitHub | Terraform attaching existing managed policy to a new role - terraform_attach_manged_role.tf
• aws_iam_policy_attachment only one per policy · Issue #4165 ... | We are trying to implement our infrastructure as a module for each service. For each service we want to create security groups, elbs, asgs and IAM roles to run the instances as. Then we attach poli...
• Managed policies and inline policies - AWS Identity and Access ... | AWS managed policies make it convenient for you to assign appropriate permissions to users, groups, and roles. It is faster than writing the policies yourself, ...