Skip to content

Commit 2de5b7c

Browse files
drosindrosin
committed
feat: support aws_dynamodb_resource_policy (closes #95)
1 parent e47cf5f commit 2de5b7c

File tree

9 files changed

+189
-0
lines changed

9 files changed

+189
-0
lines changed

‎README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ No modules.
9292
| [aws_appautoscaling_target.index_write](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_target) | resource |
9393
| [aws_appautoscaling_target.table_read](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_target) | resource |
9494
| [aws_appautoscaling_target.table_write](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_target) | resource |
95+
| [aws_dynamodb_resource_policy.table_resource_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_resource_policy) | resource |
9596
| [aws_dynamodb_table.autoscaled](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
9697
| [aws_dynamodb_table.autoscaled_gsi_ignore](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
9798
| [aws_dynamodb_table.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
@@ -120,6 +121,7 @@ No modules.
120121
| <a name="input_range_key"></a> [range\_key](#input\_range\_key) | The attribute to use as the range (sort) key. Must also be defined as an attribute | `string` | `null` | no |
121122
| <a name="input_read_capacity"></a> [read\_capacity](#input\_read\_capacity) | The number of read units for this table. If the billing\_mode is PROVISIONED, this field should be greater than 0 | `number` | `null` | no |
122123
| <a name="input_replica_regions"></a> [replica\_regions](#input\_replica\_regions) | Region names for creating replicas for a global DynamoDB table. | `any` | `[]` | no |
124+
| <a name="input_resource_based_policy_json"></a> [resource\_based\_policy\_json](#input\_resource\_based\_policy\_json) | The JSON definition of the resource-based policy. | `string` | `null` | no |
123125
| <a name="input_restore_date_time"></a> [restore\_date\_time](#input\_restore\_date\_time) | Time of the point-in-time recovery point to restore. | `string` | `null` | no |
124126
| <a name="input_restore_source_name"></a> [restore\_source\_name](#input\_restore\_source\_name) | Name of the table to restore. Must match the name of an existing table. | `string` | `null` | no |
125127
| <a name="input_restore_source_table_arn"></a> [restore\_source\_table\_arn](#input\_restore\_source\_table\_arn) | ARN of the source table to restore. Must be supplied for cross-region restores. | `string` | `null` | no |

‎examples/resource-based-policy/README.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# DynamoDB Table with resource-based policy example
2+
3+
Configuration in this directory creates AWS DynamoDB table with a resource-based policy.
4+
5+
## Usage
6+
7+
To run this example you need to execute:
8+
9+
```bash
10+
terraform init
11+
terraform plan
12+
terraform apply
13+
```
14+
15+
Note that this example may create resources which can cost money (AWS Elastic IP, for example). Run `terraform destroy` when you don't need these resources.
16+
17+
<!-- BEGIN_TF_DOCS -->
18+
## Requirements
19+
20+
| Name | Version |
21+
|------|---------|
22+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
23+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.72.1 |
24+
| <a name="requirement_random"></a> [random](#requirement\_random) | >= 2.0 |
25+
26+
## Providers
27+
28+
| Name | Version |
29+
|------|---------|
30+
| <a name="provider_random"></a> [random](#provider\_random) | >= 2.0 |
31+
32+
## Modules
33+
34+
| Name | Source | Version |
35+
|------|--------|---------|
36+
| <a name="module_disabled_dynamodb_table"></a> [disabled\_dynamodb\_table](#module\_disabled\_dynamodb\_table) | ../../ | n/a |
37+
| <a name="module_dynamodb_table"></a> [dynamodb\_table](#module\_dynamodb\_table) | ../../ | n/a |
38+
39+
## Resources
40+
41+
| Name | Type |
42+
|------|------|
43+
| [random_pet.this](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource |
44+
45+
## Inputs
46+
47+
No inputs.
48+
49+
## Outputs
50+
51+
| Name | Description |
52+
|------|-------------|
53+
| <a name="output_dynamodb_table_arn"></a> [dynamodb\_table\_arn](#output\_dynamodb\_table\_arn) | ARN of the DynamoDB table |
54+
| <a name="output_dynamodb_table_id"></a> [dynamodb\_table\_id](#output\_dynamodb\_table\_id) | ID of the DynamoDB table |
55+
| <a name="output_dynamodb_table_stream_arn"></a> [dynamodb\_table\_stream\_arn](#output\_dynamodb\_table\_stream\_arn) | The ARN of the Table Stream. Only available when var.stream\_enabled is true |
56+
| <a name="output_dynamodb_table_stream_label"></a> [dynamodb\_table\_stream\_label](#output\_dynamodb\_table\_stream\_label) | A timestamp, in ISO 8601 format of the Table Stream. Only available when var.stream\_enabled is true |
57+
<!-- END_TF_DOCS -->

‎examples/resource-based-policy/main.tf

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
provider "aws" {
2+
region = "eu-west-1"
3+
}
4+
5+
resource "random_pet" "this" {
6+
length = 2
7+
}
8+
9+
module "dynamodb_table" {
10+
source = "../../"
11+
12+
name = "my-table-${random_pet.this.id}"
13+
hash_key = "id"
14+
range_key = "title"
15+
table_class = "STANDARD"
16+
deletion_protection_enabled = false
17+
18+
attributes = [
19+
{
20+
name = "id"
21+
type = "N"
22+
},
23+
{
24+
name = "title"
25+
type = "S"
26+
},
27+
{
28+
name = "age"
29+
type = "N"
30+
}
31+
]
32+
33+
global_secondary_indexes = [
34+
{
35+
name = "TitleIndex"
36+
hash_key = "title"
37+
range_key = "age"
38+
projection_type = "INCLUDE"
39+
non_key_attributes = ["id"]
40+
41+
on_demand_throughput = {
42+
max_write_request_units = 1
43+
max_read_request_units = 1
44+
}
45+
}
46+
]
47+
48+
on_demand_throughput = {
49+
max_read_request_units = 1
50+
max_write_request_units = 1
51+
}
52+
53+
resource_based_policy_json = <<POLICY
54+
{
55+
"Version": "2012-10-17",
56+
"Statement": [
57+
{
58+
"Sid": "AllowDummyRoleAccess",
59+
"Effect": "Allow",
60+
"Principal": {
61+
"AWS": "arn:aws:iam::222222222222:role/DummyRole"
62+
},
63+
"Action": "dynamodb:GetItem",
64+
"Resource": "arn:aws:dynamodb:eu-west-1:111111111111:table/DummyTable"
65+
}
66+
]
67+
}
68+
POLICY
69+
# the account ids and table name are placeholders and should be replaced with the actual values
70+
71+
72+
tags = {
73+
Terraform = "true"
74+
Environment = "staging"
75+
}
76+
}
77+
78+
79+
module "disabled_dynamodb_table" {
80+
source = "../../"
81+
82+
create_table = false
83+
}

‎examples/resource-based-policy/outputs.tf

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "dynamodb_table_arn" {
2+
description = "ARN of the DynamoDB table"
3+
value = module.dynamodb_table.dynamodb_table_arn
4+
}
5+
6+
output "dynamodb_table_id" {
7+
description = "ID of the DynamoDB table"
8+
value = module.dynamodb_table.dynamodb_table_id
9+
}
10+
11+
output "dynamodb_table_stream_arn" {
12+
description = "The ARN of the Table Stream. Only available when var.stream_enabled is true"
13+
value = module.dynamodb_table.dynamodb_table_stream_arn
14+
}
15+
16+
output "dynamodb_table_stream_label" {
17+
description = "A timestamp, in ISO 8601 format of the Table Stream. Only available when var.stream_enabled is true"
18+
value = module.dynamodb_table.dynamodb_table_stream_label
19+
}

‎examples/resource-based-policy/variables.tf

Whitespace-only changes.

‎examples/resource-based-policy/versions.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.0"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.72.1"
8+
}
9+
random = {
10+
source = "hashicorp/random"
11+
version = ">= 2.0"
12+
}
13+
}
14+
}

‎main.tf

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -376,3 +376,10 @@ resource "aws_dynamodb_table" "autoscaled_gsi_ignore" {
376376
ignore_changes = [global_secondary_index, read_capacity, write_capacity]
377377
}
378378
}
379+
380+
resource "aws_dynamodb_resource_policy" "table_resource_policy" {
381+
count = var.create_table && var.resource_based_policy_json != null ? 1 : 0
382+
383+
resource_arn = try(aws_dynamodb_table.this[0].arn, aws_dynamodb_table.autoscaled[0].arn, aws_dynamodb_table.autoscaled_gsi_ignore[0].arn, "")
384+
policy = var.resource_based_policy_json
385+
}

‎variables.tf

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,3 +209,9 @@ variable "restore_to_latest_time" {
209209
type = bool
210210
default = null
211211
}
212+
213+
variable "resource_based_policy_json" {
214+
description = "The JSON definition of the resource-based policy."
215+
type = string
216+
default = null
217+
}

‎wrappers/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ module "wrapper" {
2727
range_key = try(each.value.range_key, var.defaults.range_key, null)
2828
read_capacity = try(each.value.read_capacity, var.defaults.read_capacity, null)
2929
replica_regions = try(each.value.replica_regions, var.defaults.replica_regions, [])
30+
resource_based_policy_json = try(each.value.resource_based_policy_json, var.defaults.resource_based_policy_json, null)
3031
restore_date_time = try(each.value.restore_date_time, var.defaults.restore_date_time, null)
3132
restore_source_name = try(each.value.restore_source_name, var.defaults.restore_source_name, null)
3233
restore_source_table_arn = try(each.value.restore_source_table_arn, var.defaults.restore_source_table_arn, null)

0 commit comments

Comments
 (0)