> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# IAM Policies with Terraform
> Learn to create and attach IAM policies using Terraform, following the principle of least privilege for AWS users.
In this lesson, you will learn how to create IAM policies using Terraform and attach them to an AWS user. We will use the example of an IAM user named Lucy, who initially has no permissions. By following the principle of least privilege, we will incrementally grant her the required permissions.
Always start AWS users with the least privilege and only grant specific permissions as needed.
## Prerequisites
Before you begin, ensure you have an IAM user created. In our example, Lucy has already been created.
## Creating an IAM Policy Document
AWS uses JSON-formatted policy documents to define permissions. Below is an example of an administrator access policy document:
```json theme={null}
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
```
## Defining Resources in Terraform
To add permissions via Terraform, you will use the `aws_iam_policy` resource. According to the [AWS Terraform Provider Documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy), the only mandatory argument for this resource is the policy document in JSON format.
### Step 1: Declare the IAM User and IAM Policy
Below is a Terraform configuration snippet that first defines the IAM user resource, followed by the IAM policy resource:
```hcl theme={null}
resource "aws_iam_user" "admin-user" {
name = "lucy"
tags = {
Description = "Technical Team Leader"
}
}
resource "aws_iam_policy" "adminUser" {
name = "AdminUsers"
policy = ?
}
```
### Step 2: Incorporate the Policy Document with Heredoc Syntax
One efficient method to include the policy document within your Terraform configuration is to use a heredoc. This allows you to embed multi-line strings without external file references. Here’s how to integrate the JSON document using this syntax:
```hcl theme={null}
resource "aws_iam_user" "admin-user" {
name = "lucy"
tags = {
Description = "Technical Team Leader"
}
}
resource "aws_iam_policy" "adminUser" {
name = "AdminUsers"
policy = <
Double-check your IAM policies and user attachments to ensure you are not inadvertently granting excessive permissions.
## Alternative Approach: Using an External JSON File
An alternative method to define the IAM policy document is to store it in an external file. This can enhance readability and maintainability.
### Steps to Use an External File:
1. Create a file named `admin-policy.json` in the same directory as your `main.tf`.
2. Move the JSON policy document into `admin-policy.json`.
Update the IAM policy resource to read the policy document using the `file` function:
```hcl theme={null}
resource "aws_iam_policy" "adminUser" {
name = "AdminUsers"
policy = file("admin-policy.json")
}
```
The remainder of the configuration remains unchanged.
## Summary
In this lesson, you learned how to create an IAM policy with Terraform and attach it to an IAM user. These techniques are essential for managing AWS permissions securely and efficiently. Continue practicing these methods with practical exercises to master AWS infrastructure provisioning with Terraform.
For more information on IAM policies and Terraform, refer to:
* [Terraform AWS Provider - IAM Policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy)
* [AWS IAM Documentation](https://docs.aws.amazon.com/iam/)