35
13

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 5 years have passed since last update.

terraform の aws_iam_policy_attachment は使わないほうが無難

Last updated at Posted at 2019-02-07

はじめに

aws_iam_policy_attachment でuser/role/groupとポリシーを紐付けている場合、 terraform apply したときに既存で紐づけている別のuser/role/groupのポリシーが剥がれてしまうことがあるようです。
原因は aws_iam_policy_attachment でポリシーを紐付ける場合の aws provider の仕様のためで、
代替として、 aws_iam_role_policy_attachment などを使って紐付けるようにしましょう。

問題点

aws_iam_policy_attachment でuser/role/groupとポリシーを紐付けている場合、 terraform apply したときに既存で紐づけている別のuser/role/groupのポリシーが剥がれてしまうことがある

原因

terraform の公式ドキュメント[2]では以下のような警告がされている。

WARNING: The aws_iam_policy_attachment resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single aws_iam_policy_attachment resource.
This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource.

aws_iam_policy_attachment で紐付けられているもの以外はポリシーが剥奪されてしまうらしい

解決策

代替として、aws_iam_role_policy_attachment, aws_iam_group_policy_attachment, aws_iam_user_policy_attachment を使うよう勧めている。

Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead. These resources do not enforce exclusive attachment of an IAM policy.

terraform の AWS provider の仕様ということですが、意図しない変更になりやすいので、最初から aws_iam_policy_attachment でなく aws_iam_role_policy_attachment などを使ったほうが無難だと思います。

参考

こちらの記事も参考にしてください。

35
13
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
35
13

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?