TerraformでIAMポリシーをコード管理する方法｜aws_iam_policy_documentで最小権限を宣言的に書く

この記事のポイント

・aws_iam_policy_documentはIAMポリシーJSONをHCLで書くためのdata sourceで、コードレビューが可能になる
・statementブロックにactions/resources/effectを明示し、最小権限を宣言的に設計できる
・Conditionブロックを使うとIPアドレス制限やMFA必須などの細かい権限制御ができる
・tfstateにIAMアクセスキーが入るリスクに注意し、IAMロール設計を優先する

# terraform plan を実行してIAMポリシーの変更差分を確認する例
$ terraform plan

  # aws_iam_policy.s3_read_only will be updated in-place
  ~ resource "aws_iam_policy" "s3_read_only" {
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                      ~ Action   = [
                            "s3:GetObject",
                            "s3:ListBucket",
                          + "s3:PutObject",   # 追加される権限
                        ]
                    }
                ]
            }
        )
    }

Plan: 0 to add, 1 to change, 0 to destroy.

# S3バケット読み取り専用ポリシーのdata source定義
data "aws_iam_policy_document" "s3_read_only" {
  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::my-app-bucket",
      "arn:aws:s3:::my-app-bucket/*",
    ]
  }
}

data "aws_iam_policy_document" "app_policy" {
  # S3読み取り
  statement {
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:ListBucket",
    ]
    resources = [
      "arn:aws:s3:::my-app-bucket",
      "arn:aws:s3:::my-app-bucket/*",
    ]
  }

  # SSMパラメータストアからの設定値取得
  statement {
    effect  = "Allow"
    actions = [
      "ssm:GetParameter",
      "ssm:GetParametersByPath",
    ]
    resources = [
      "arn:aws:ssm:ap-northeast-1:*:parameter/myapp/*",
    ]
  }

  # IAM操作は明示的Denyで封鎖
  statement {
    effect    = "Deny"
    actions   = ["iam:*"]
    resources = ["*"]
  }
}

data "aws_iam_policy_document" "s3_ip_restricted" {
  statement {
    effect  = "Allow"
    actions = ["s3:GetObject"]
    resources = ["arn:aws:s3:::my-secure-bucket/*"]

    condition {
      test     = "IpAddress"
      variable = "aws:SourceIp"
      values   = ["203.0.113.0/24"]
    }
  }
}

data "aws_iam_policy_document" "require_mfa" {
  statement {
    effect    = "Deny"
    actions   = ["*"]
    resources = ["*"]

    condition {
      test     = "BoolIfExists"
      variable = "aws:MultiFactorAuthPresent"
      values   = ["false"]
    }
  }
}

# ポリシードキュメントのdata source
data "aws_iam_policy_document" "s3_read_only" {
  statement {
    effect  = "Allow"
    actions = ["s3:GetObject", "s3:ListBucket"]
    resources = [
      aws_s3_bucket.app.arn,
      "${aws_s3_bucket.app.arn}/*",
    ]
  }
}

# IAMポリシーリソースの作成
resource "aws_iam_policy" "s3_read_only" {
  name        = "${var.env}-s3-read-only"
  description = "S3バケット読み取り専用ポリシー（${var.env}環境）"
  policy      = data.aws_iam_policy_document.s3_read_only.json
}

# 信頼ポリシー（EC2からのAssumeRoleを許可）
data "aws_iam_policy_document" "assume_ec2" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

# IAMロールの作成
resource "aws_iam_role" "app_role" {
  name               = "${var.env}-app-role"
  assume_role_policy = data.aws_iam_policy_document.assume_ec2.json

  tags = {
    Env = var.env
  }
}

# IAMポリシーのアタッチ
resource "aws_iam_role_policy_attachment" "app_s3" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.s3_read_only.arn
}

# インスタンスプロファイル（EC2へ割り当てるためのラッパー）
resource "aws_iam_instance_profile" "app" {
  name = "${var.env}-app-profile"
  role = aws_iam_role.app_role.name
}

# Terraform実行ロールに必要なIAM権限（最小）
"iam:CreatePolicy",
"iam:GetPolicy",
"iam:GetPolicyVersion",
"iam:ListPolicyVersions",
"iam:DeletePolicy",
"iam:CreatePolicyVersion",
"iam:DeletePolicyVersion",
"iam:CreateRole",
"iam:GetRole",
"iam:DeleteRole",
"iam:AttachRolePolicy",
"iam:DetachRolePolicy",
"iam:ListAttachedRolePolicies",
"iam:PassRole",
"iam:CreateInstanceProfile",
"iam:DeleteInstanceProfile",
"iam:GetInstanceProfile",
"iam:AddRoleToInstanceProfile",
"iam:RemoveRoleFromInstanceProfile"

# ポリシーを機能単位に分割してアタッチ
resource "aws_iam_role_policy_attachment" "s3" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.s3_read_only.arn
}

resource "aws_iam_role_policy_attachment" "ssm" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.ssm_readonly.arn
}

resource "aws_iam_role_policy_attachment" "cloudwatch" {
  role       = aws_iam_role.app_role.name
  policy_arn = aws_iam_policy.cloudwatch_write.arn
}