rvn-aws-iam-policy · Latest version: 0.1.0
Readme
Creates one reusable customer-managed AWS IAM policy from structured statements or a complete JSON policy document.Overview
Use this module when permissions need to be managed independently from an IAM role. The policy ARN can be attached to one or more roles, reused across workloads, or supplied as a permissions boundary. Customer-managed policies are versioned by AWS when their document changes. Keep statements narrowly scoped to the actions and resource ARNs each workload needs.Use cases
Policy documents
Structured statements are the default. Each statement requires an effect, either Action or NotAction values, and either Resource or NotResource values. Optional conditions can restrict access by IAM context keys such as account, source ARN, principal tags, or resource tags. NotAction and NotResource invert what a statement matches. They can simplify explicit deny policies, but combining either with Allow can grant broader access than expected. Prefer listed actions and resources unless an inverse statement is necessary. JSON document accepts a complete IAM policy document. Use this mode for uncommon IAM elements or documents produced by another trusted policy-authoring workflow. The JSON document replaces structured statements rather than merging with them. IAM policies can have broad security impact. Avoid wildcard actions and resources unless the AWS service requires them, and add conditions where they reduce unintended access.Using the policy
This module creates the policy but does not attach it. Attach the Policy ARN output through the AWS IAM Role module’s Managed policy ARNs setting, or use it as that module’s Permission boundary ARN. Keeping policy creation and role creation separate allows a policy to be shared, audited, and updated without duplicating role trust configuration.Configuration
Design decisions
The module manages one policy and no attachments. IAM roles, users, and groups have separate lifecycles, while a customer-managed policy may be shared by several consumers. Structured statements require an explicit Action or NotAction choice and an explicit Resource or NotResource choice. The module does not add wildcard permissions automatically. Policy name, description, and path are immutable in Ravion because AWS replaces the managed policy when any of these values change. Replacement would sever attachments managed outside this module. Ravion adds standard tags for ownership and traceability. User-provided Tags are merged on top for team, cost, or environment metadata.Learn more
Inputs reference
All inputs forrvn-aws-iam-policy version 0.1.0. Use the name shown for each field as the input key in module config.
AWS account & region
string
required
AWS account.
- Immutable after creation
string
required
Region.
- Immutable after creation
IAM policy
string
required
Policy name. Name of the customer-managed IAM policy. Policy names must be unique within their path in the AWS account.
- Default:
<<module.given_id>> - Immutable after creation
- Pattern:
^[A-Za-z0-9+=,.@_-]{1,128}$— 1-128 letters, numbers, plus, equals, comma, period, at, underscore, or hyphen characters.
string
Description. Optional description stored on the IAM policy. AWS does not allow this value to be changed after creation.
- Immutable after creation
- Pattern:
^.{0,1000}$— 1000 characters or fewer.
string
required
Path. IAM path for organizing the policy. Most policies should use the root path.
- Default:
/ - Immutable after creation
- Pattern:
^/$|^/.*/$— Start and end with a slash, for example / or /application/. - Pattern:
^[^*]*$— Asterisks are not allowed in IAM paths. - Pattern:
^.{1,512}$— 512 characters or fewer.
Policy document
string
required
Policy document format. Build the policy with structured statements or provide a complete JSON document.
- Default:
structured - Allowed values:
structured(Structured statements),json(JSON document)
object_array
required
Policy statements. Define permissions this policy grants or denies. Each statement matches Action or NotAction values against Resource or NotResource ARNs and can add conditions to narrow access. Prefer explicit actions and resource ARNs over wildcards.
- Default:
[] - Shown when:
{"policy_document_mode":"structured"}
text
required
Policy JSON. Complete IAM policy JSON document. This is used instead of structured statements.
- Pattern:
^\s*\{[\s\S]*"Version"[\s\S]*"Statement"[\s\S]*\}\s*$— Include a JSON object with Version and Statement properties. - Shown when:
{"policy_document_mode":"json"}
Misc
keyvalue
Tags. A map of tags to assign to all resources. Default tags are
Owner, ProjectGivenId, EnvironmentGivenId, ModuleGivenId, ModuleIdTerraform settings
string
OpenTofu version override. Override the environment’s default version for this module
string
Ravion Terraform workspace name. Override Terraform state backend workspace name. Defaults to project + environment + module given ids.
- Immutable after creation
object
Advanced Terraform variables. Optional raw Terraform variable overrides for advanced module inputs or one-off overrides. Values here override the generated variables above.
- Default:
{}
string
Terraform execution environment. Override the execution environment for Terraform runners. Must use the same AWS account as selected above.