Ignore lifecycle for AWS IAM in-line policy (#499)

* Ignore lifecycle for AWS IAM in-line policy Signed-off-by: Sasikanth Eda <[email protected]> * Improve comment Signed-off-by: Sasikanth Eda <[email protected]> * Correct comment typo Signed-off-by: Sasikanth Eda <[email protected]> --------- Signed-off-by: Sasikanth Eda <[email protected]>
IBM · Mar 25, 2024 · b263cb7 · b263cb7
1 parent 1d5279a
commit b263cb7
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 4 deletions.
diff --git a/aws_scale_templates/sub_modules/instance_template/main.tf b/aws_scale_templates/sub_modules/instance_template/main.tf
@@ -70,10 +70,6 @@ module "cluster_host_iam_policy" {
                 "ec2:CreateTags*",
                 "ec2:ModifyInstanceAttribute",
                 "iam:GetRole",
-                "ssm:DescribeParameters",
-                "ssm:PutParameter",
-                "ssm:GetParameter",
-                "ssm:DeleteParameters",
                 "sns:DeleteTopic",
                 "sns:CreateTopic",
                 "sns:Unsubscribe",

diff --git a/resources/aws/security/iam/iam_role_policy/iam_role_policy.tf b/resources/aws/security/iam/iam_role_policy/iam_role_policy.tf
@@ -12,6 +12,10 @@ resource "aws_iam_role_policy" "itself" {
   name_prefix = var.role_policy_name_prefix
   role        = element(var.iam_role_id, count.index)
   policy      = var.iam_role_policy
+  # Admin might add/link custom IAM policies, hence avoid to overwrite it
+  lifecycle {
+    ignore_changes = all
+  }
 }
 
 output "role_name" {