Skip to content

Commit

Permalink
fix docs
Browse files Browse the repository at this point in the history
  • Loading branch information
kayman-mk committed Dec 14, 2024
1 parent e8a14e9 commit 593ea17
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 4 deletions.
7 changes: 3 additions & 4 deletions docs/rules/aws_iam_policy_attachment_exclusive_attachment.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,13 @@ $ tflint
1 issue(s) found:
Warning: Consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment instead. (aws_iam_policy_attachment_has_alternatives)
on template.tf line 2:
2: name "test_attachment" // Consider alternatives!

2: name "test_attachment"
```

## Why

The `aws_iam_policy_attachment` resource creates exclusive attachments of IAM policies. Across the entire AWS account, all of the users/roles/groups to which a single policy is attached must be declared by a single `aws_iam_policy_attachment` resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment
The `aws_iam_policy_attachment` resource creates exclusive attachments of IAM policies. Across the entire AWS account, all the users/roles/groups to which a single policy is attached must be declared by a single `aws_iam_policy_attachment` resource. This means that even any users/roles/groups that have the attached policy via any other mechanism (including other Terraform resources) will have that attached policy revoked by this resource. https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment

## How To Fix

Consider `aws_iam_role_policy_attachment`, `aws_iam_user_policy_attachment`, or `aws_iam_group_policy_attachment` instead. These resources do not enforce exclusive attachment of an IAM policy.
Consider using `aws_iam_role_policy_attachment`, `aws_iam_user_policy_attachment`, or `aws_iam_group_policy_attachment` instead. These resources do not enforce exclusive attachment of an IAM policy.
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ import (

func Test_AwsIAMPolicyAttachmentExclusiveAttachmentRule(t *testing.T) {
rand.Seed(time.Now().UnixNano())

cases := []struct {
Name string
Content string
Expand Down

0 comments on commit 593ea17

Please sign in to comment.