Terraform guide to IAM Policies: The Two Cases You Need to Know

Short summary

AWS IAM policies in Terraform follow two clear patterns based on availability. Case 1: When AWS provides a pre-built managed policy for your exact needs (like for Lambda logging or VPC access), reference it by ARN and attach directly to your role. Case 2: When AWS lacks a managed policy matching your requirements, write a custom policy document, create an IAM policy from it, then attach to your role. This two-path decision tree eliminates confusion when learning Terraform IAM.

• •Use AWS managed policies when available; attach directly via aws_iam_role_policy_attachment
• •Build custom policies with policy document → policy resource → attach for specific needs
• •Decision framework: Does AWS provide this policy? Yes = attach. No = create custom policy.

Generated with AI, which can make mistakes.