Remove principal type AWS from IAM policy wildcard normalization

[spirius]

The normalized IAM policies for wildcard principals are not accepted by IAM when used as trust policy for roles. According to AWS IAM doc it should be fine, but in practice IAM returns MalformedPolicyDocument: AssumeRolepolicy contained an invalid principal: "STAR":"*" error.

Basically following terraform code doesn't work, because it normalizes principal to "Principal": "*", and it is not possible to get {"Principal": {"AWS": *}} in rendered policy when using aws_iam_policy_document data source

data "aws_iam_policy_document" "policy" {
  statement {
    effect = "Deny"
    actions = ["sts:AssumeRole"]
    principals {
      type = "AWS"
      identifiers = ["*"]
    }
  }
}

resource "aws_iam_role" "role" {
  name = "test_role"
  assume_role_policy = "${data.aws_iam_policy_document.policy.json}"
}

Without normalization it works as expected:

resource "aws_iam_role" "role" {
  name = "test_role"
  assume_role_policy = <<EOS
{
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "sts:AssumeRole",
      "Principal": {
        "AWS": "*"
      }
    }
  ]
}
EOS
}

The PR removes principal type "AWS" from normalization.

[spirius]

Test results

$ TF_ACC=1 go test -v -run=TestAccAWSDataSourceIAMPolicyDocument_* -timeout 120m
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_basic
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_basic (18.33s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_source
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_source (27.55s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_sourceConflicting
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_sourceConflicting (17.95s)
=== RUN   TestAccAWSDataSourceIAMPolicyDocument_override
--- PASS: TestAccAWSDataSourceIAMPolicyDocument_override (18.05s)
PASS
ok  	github.com/terraform-providers/terraform-provider-aws/aws	81.920s

[bflad]

I think this is a good idea, but we should add some additional user-facing documentation surrounding the various principal behaviors on the aws_iam_policy_document data source page. Can you include some additional verbiage in the principal(/type) section and/or bottom examples section please? We should call out the support for type = "*" explicitly at least.

MAINTAINER NOTE: This will require a NOTE callout in the CHANGELOG, preferably linking to the above documentation enhancements

[spirius]

@bflad, added new section in docs about wildcard principals

[bflad]

Thanks @spirius! I think this is a good change to get in as it is technically more correct/expected behavior. I will write up a note in the CHANGELOG regarding this change as its bound to cause some initial confusion for those depending on the old behavior.

[bflad]

This has been released in version 1.19.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!