Hi team,
Another day - another challenge, any feedback appreciated.
Kindly suggest what rules we need to follow or simply memorize by hard to make changes readable.
Example of plan output that we deal with a lot
Note: Objects have changed outside of Terraform
Terraform detected the following changes made outside of Terraform since the
last "terraform apply":
# aws_s3_bucket.this has changed
~ resource "aws_s3_bucket" "this" {
id = "adl-enriched-ap-cf-salesforce-outbound-dev-46x1vb"
~ policy = jsonencode(
~ {
~ Statement = [
~ {
~ Principal = {
~ AWS = [
+ "arn:aws:iam::111111111111:role/IAMAdminAccessRole",
+ "arn:aws:iam::111111111111:role/DeveloperAccessRole",
+ "arn:aws:iam::111111111111:role/BillingAccessRole",
+ "arn:aws:iam::111111111111:role/DataConsumerAccessRole",
"arn:aws:iam::111111111111:role/SupportAccessRole",
"arn:aws:iam::111111111111:role/DataScientistAccessRole",
+ "arn:aws:iam::111111111111:role/SecurityAuditAccessRole",
+ "arn:aws:iam::111111111111:role/DevOpsAccessRole",
+ "arn:aws:iam::111111111111:role/NetworkAdminAccessRole",
"arn:aws:iam::111111111111:role/EC2AdminAccessRole",
# (1 unchanged element hidden)
"arn:aws:iam::111111111111:role/S3AdminAccessRole",
- "arn:aws:iam::111111111111:role/DevOpsAccessRole",
- "arn:aws:iam::111111111111:role/SecurityAuditAccessRole",
- "arn:aws:iam::111111111111:role/PowerUserAccessRole",
- "arn:aws:iam::111111111111:role/DeveloperAccessRole",
- "arn:aws:iam::111111111111:role/IAMAdminAccessRole",
- "arn:aws:iam::111111111111:role/NetworkAdminAccessRole",
- "arn:aws:iam::111111111111:role/BillingAccessRole",
- "arn:aws:iam::111111111111:role/DataConsumerAccessRole",
"arn:aws:iam::111111111111:role/AdministratorAccessRole",
+ "arn:aws:iam::111111111111:role/PowerUserAccessRole",
"arn:aws:iam::111111111111:role/DataPublisherAccessRole",
]
}
# (5 unchanged elements hidden)
},
....
I suspect but didn’t test the right way to define to policy not with json but with aws_iam_policy_document but that is probably just a tip of an iceberg.
As always, appreciate you feedback.