I need to add a set of permissions to permissions sets for sso. The policies are enormous (over the 6000 ish char limit) so I have 12 policies in JSON format.
I have hit a number of hurdles in adding all these as a single permission set and I'm looking to see if anyone has a definitive working method of accomplishing this.
I have tried a number of ways and wont waste your re time asking you to read theses if there is one working way
data "aws_ssoadmin_instances" "ReadOnly" {}
resource "aws_ssoadmin_permission_set" "ReadOnly" {
name = "ReadOnly"
description = "Read Only Perm Set to ALL resources"
instance_arn = tolist(data.aws_ssoadmin_instances.ReadOnly.arns)[0]
session_duration = "PT10H"
}
resource "aws_iam_policy" "ReadOnly-Extras-a" {
name = "ReadOnly-Extras1"
policy = file("policies/readonly1.json")
}
resource "aws_iam_policy" "ReadOnly-Extras-b" {
name = "ReadOnly-Extras2"
policy = file("policies/readonly2.json")
}
resource "aws_iam_policy" "ReadOnly-Extras-c" {
name = "ReadOnly-Extras3"
policy = file("policies/readonly3.json")
}
resource "aws_iam_policy" "ReadOnly-Extras-d" {
name = "ReadOnly-Extras4"
policy = file("policies/readonly4.json")
}
resource "aws_iam_policy" "ReadOnly-Extras-e" {
name = "ReadOnly-Extras5"
policy = file("policies/readonly5.json")
}
data "aws_iam_policy_document" "ReadOnly" {
source_policy_documents = [
aws_iam_policy.ReadOnly-Extras-a.policy,
aws_iam_policy.ReadOnly-Extras-b.policy,
aws_iam_policy.ReadOnly-Extras-c.policy,
aws_iam_policy.ReadOnly-Extras-d.policy,
aws_iam_policy.ReadOnly-Extras-e.policy]
}
resource "aws_ssoadmin_permission_set_inline_policy" "ReadOnly" {
inline_policy = data.aws_iam_policy_document.ReadOnly.json
instance_arn = aws_ssoadmin_permission_set.ReadOnly.instance_arn
permission_set_arn = aws_ssoadmin_permission_set.ReadOnly.arn
}
locals {
readOnly_policies = [
"arn:aws:iam::aws:policy/job-function/ViewOnlyAccess",
"arn:aws:iam::aws:policy/AWSBillingReadOnlyAccess"]
}
resource "aws_ssoadmin_managed_policy_attachment" "ReadOnly" {
instance_arn = tolist(data.aws_ssoadmin_instances.ReadOnly.arns)[0]
count = length(local.readOnly_policies)
managed_policy_arn = local.readOnly_policies[count.index]
permission_set_arn = aws_ssoadmin_permission_set.ReadOnly.arn
}
Spoke with AWS direct
1 - yes the limit is real and cant be changed and policy needs less text (thankyou @luk2302)
2 - the major issue was, the AWS managed permset AWSReadonly has the LISTonly policy (it has a lot less rights than READ only policy :/). So I was able to use this and that made my inline policy for the permset ALOT shorter