[Enhancement]: aws_iam_policy data source could expose policy version and update date

[nitrocode]

Description

I'd like to create custom iam policies and base them off of managed policies. I want to tag those custom policies with the exact version of the policies they are based on. This would be nice to pin my policies instead of using the aws managed policies. Then I can bump the policies as I see fit periodically.

Affected Resource(s) and/or Data Source(s)

• aws_iam_policy's UpdateDate and DefaultVersionId

Potential Terraform Configuration

data "aws_iam_policy" "example" {
  arn = "arn:aws:iam::123456789012:policy/UsersManageOwnCredentials"
}

output "policy_version" {
  value = data.aws_iam_policy.example.version
}

output "policy_update_date" {
  value = data.aws_iam_policy.example.update_date
}

References

• https://docs.aws.amazon.com/cli/latest/reference/iam/get-policy.html

Would you like to implement a fix?

No

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[justinretzolk]

Hey @nitrocode 👋 Thank you for taking the time to raise this! I may be overlooking something specific here, but my initial reaction is that you could use jsondecode() on the policy attribute to get that information with how the data source works today. Would that work for your use case?

[nitrocode]

Hi Justin 🤝

Here is an example of the terraform

data "aws_iam_policy" "poweruser" {
  arn = "arn:aws:iam::aws:policy/PowerUserAccess"
}

output "policy" {
  value = data.aws_iam_policy.poweruser
}

And the terraform output

$ terraform plan 
data.aws_iam_policy.poweruser: Reading...
data.aws_iam_policy.poweruser: Read complete after 1s [id=arn:aws:iam::aws:policy/PowerUserAccess]

Changes to Outputs:
  + policy = {
      + arn              = "arn:aws:iam::aws:policy/PowerUserAccess"
      + attachment_count = 3
      + description      = "Provides full access to AWS services and resources, but does not allow management of Users and groups."
      + id               = "arn:aws:iam::aws:policy/PowerUserAccess"
      + name             = "PowerUserAccess"
      + path             = "/"
      + path_prefix      = null
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Effect    = "Allow"
                      + NotAction = [
                          + "iam:*",
                          + "organizations:*",
                          + "account:*",
                        ]
                      + Resource  = "*"
                    },
                  + {
                      + Action   = [
                          + "account:GetAccountInformation",
                          + "account:GetPrimaryEmail",
                          + "account:ListRegions",
                          + "iam:CreateServiceLinkedRole",
                          + "iam:DeleteServiceLinkedRole",
                          + "iam:ListRoles",
                          + "organizations:DescribeOrganization",
                        ]
                      + Effect   = "Allow"
                      + Resource = "*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = "snip"
      + tags             = {}
    }

If I run the awscli, I can see additional information for the policy that is unavailable in the data source

• UpdateDate
• DefaultVersionId

$ aws iam list-policies
...
        {
            "PolicyName": "PowerUserAccess",
            "PolicyId": "snip",
            "Arn": "arn:aws:iam::aws:policy/PowerUserAccess",
            "Path": "/",
            "DefaultVersionId": "v6",
            "AttachmentCount": 3,
            "PermissionsBoundaryUsageCount": 0,
            "IsAttachable": true,
            "CreateDate": "2015-02-06T18:39:47+00:00",
            "UpdateDate": "2024-08-19T16:12:55+00:00"
        },

[justinretzolk]

Makes sense, thanks for the clarification @nitrocode!