AWS invalid policy - terraform - amazon-web-services

Question

I am creating a policy and a role for API gateway to access dynamodb api endpoints with below terraform config. What am I missing? I am getting invalid policy error on terraform plan
resource "aws_iam_role_policy" "api_dbaccess_policy" {
name = "api_dbaccess_policy"
role = "${aws_iam_role.apiGatewayDynamoDbAccessRole.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:BatchGet*",
"dynamodb:DescribeStream",
"dynamodb:DescribeTable",
"dynamodb:Get*",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:BatchWrite*",
"dynamodb:CreateTable",
"dynamodb:Delete*",
"dynamodb:Update*",
"dynamodb:PutItem"
],
"Resource": "*"
}
]
}
EOF
# depends_on = [
# "aws_dynamodb_table.us-east-1"
# ]
}
resource "aws_iam_role" "apiGatewayDynamoDbAccessRole" {
name = "apiGatewayDynamoDbAccessRole"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"apigateway.amazonaws.com"
]
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
What am i doing wrong? I am getting invalid policy error.

Answer 1

As already mentioned, just remove the indention in the EOF block...
Another option is to use the aws_iam_policy_document data source. For me it is a cleaner approach and is better maintainable, e.g. when you are using an IDE with terraform support.
Your config would look like this ("Effect": "Allow" is not needed here, because it's default behavior):
resource "aws_iam_role_policy" "api_dbaccess_policy" {
name = "api_dbaccess_policy"
role = "${aws_iam_role.apiGatewayDynamoDbAccessRole.id}"
policy = "${data.aws_iam_policy_document.dynamodb.json}"
}
resource "aws_iam_role" "apiGatewayDynamoDbAccessRole" {
name = "apiGatewayDynamoDbAccessRole"
assume_role_policy = "${data.aws_iam_policy_document.apigateway.json}"
}
data "aws_iam_policy_document" "dynamodb" {
statement {
actions = [
"dynamodb:BatchGet*",
"dynamodb:DescribeStream",
"dynamodb:DescribeTable",
"dynamodb:Get*",
"dynamodb:Query",
"dynamodb:Scan",
"dynamodb:BatchWrite*",
"dynamodb:CreateTable",
"dynamodb:Delete*",
"dynamodb:Update*",
"dynamodb:PutItem"
]
resources = ["*"]
}
}
data "aws_iam_policy_document" "apigateway" {
statement {
actions = ["sts:AssumeRole"]
principals {
type = "Service"
identifiers = ["apigateway.amazonaws.com"]
}
}
}