Search code examples
amazon-web-servicesterraformsingle-sign-on

Add multiple policies to sso inline permissions in terraform


I need to add a set of permissions to permissions sets for sso. The policies are enormous (over the 6000 ish char limit) so I have 12 policies in JSON format.

I have hit a number of hurdles in adding all these as a single permission set and I'm looking to see if anyone has a definitive working method of accomplishing this.

I have tried a number of ways and wont waste your re time asking you to read theses if there is one working way

data "aws_ssoadmin_instances" "ReadOnly" {}

resource "aws_ssoadmin_permission_set" "ReadOnly" {
    name             = "ReadOnly"
    description      = "Read Only Perm Set to ALL resources"
    instance_arn     = tolist(data.aws_ssoadmin_instances.ReadOnly.arns)[0]
    session_duration = "PT10H"
}

resource "aws_iam_policy" "ReadOnly-Extras-a" {
    name   = "ReadOnly-Extras1"
    policy = file("policies/readonly1.json")
}

resource "aws_iam_policy" "ReadOnly-Extras-b" {
    name   = "ReadOnly-Extras2"
    policy = file("policies/readonly2.json")
}

resource "aws_iam_policy" "ReadOnly-Extras-c" {
    name   = "ReadOnly-Extras3"
    policy = file("policies/readonly3.json")
}

resource "aws_iam_policy" "ReadOnly-Extras-d" {
    name   = "ReadOnly-Extras4"
    policy = file("policies/readonly4.json")
}

resource "aws_iam_policy" "ReadOnly-Extras-e" {
    name   = "ReadOnly-Extras5"
    policy = file("policies/readonly5.json")
}

data "aws_iam_policy_document" "ReadOnly" {
    source_policy_documents = [
    aws_iam_policy.ReadOnly-Extras-a.policy, 
    aws_iam_policy.ReadOnly-Extras-b.policy,
    aws_iam_policy.ReadOnly-Extras-c.policy, 
    aws_iam_policy.ReadOnly-Extras-d.policy,
    aws_iam_policy.ReadOnly-Extras-e.policy]
}

resource "aws_ssoadmin_permission_set_inline_policy" "ReadOnly" {
    inline_policy      = data.aws_iam_policy_document.ReadOnly.json
    instance_arn       = aws_ssoadmin_permission_set.ReadOnly.instance_arn
    permission_set_arn = aws_ssoadmin_permission_set.ReadOnly.arn
}

locals {
    readOnly_policies = [
    "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
    "arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess"]
}

resource "aws_ssoadmin_managed_policy_attachment" "ReadOnly" {
    instance_arn       = tolist(data.aws_ssoadmin_instances.ReadOnly.arns)[0]
    count              = length(local.readOnly_policies)
    managed_policy_arn = local.readOnly_policies[count.index]
    permission_set_arn = aws_ssoadmin_permission_set.ReadOnly.arn
}

Solution

  • Spoke with AWS direct

    1 - yes the limit is real and cant be changed and policy needs less text (thankyou @luk2302)

    2 - the major issue was, the AWS managed permset AWSReadonly has the LISTonly policy (it has a lot less rights than READ only policy :/). So I was able to use this and that made my inline policy for the permset ALOT shorter