chore: Sort IAM policy actions alphabetically

data.tf

@@ -26,12 +26,12 @@ data "aws_iam_policy_document" "eks_key" {
     sid    = "Allow access for all principals in the account that are authorized"
     effect = "Allow"
     actions = [
-      "kms:Encrypt",
+      "kms:CreateGrant",
       "kms:Decrypt",
-      "kms:ReEncrypt*",
+      "kms:DescribeKey",
+      "kms:Encrypt",
       "kms:GenerateDataKey*",
-      "kms:CreateGrant",
-      "kms:DescribeKey"
+      "kms:ReEncrypt*",
     ]
     resources = ["*"]
 
@@ -62,7 +62,7 @@ data "aws_iam_policy_document" "eks_key" {
       "kms:Describe*",
       "kms:Get*",
       "kms:List*",
-      "kms:RevokeGrant"
+      "kms:RevokeGrant",
     ]
     resources = ["*"]
 
@@ -95,11 +95,11 @@ data "aws_iam_policy_document" "eks_key" {
     sid    = "Allow use of the key"
     effect = "Allow"
     actions = [
-      "kms:Encrypt",
       "kms:Decrypt",
-      "kms:ReEncrypt*",
+      "kms:DescribeKey",
+      "kms:Encrypt",
       "kms:GenerateDataKey*",
-      "kms:DescribeKey"
+      "kms:ReEncrypt*",
     ]
     resources = ["*"]
 
@@ -119,7 +119,7 @@ data "aws_iam_policy_document" "eks_key" {
     actions = [
       "kms:CreateGrant",
       "kms:ListGrants",
-      "kms:RevokeGrant"
+      "kms:RevokeGrant",
     ]
     resources = ["*"]
 

examples/analytics/emr-on-eks/main.tf

@@ -401,11 +401,11 @@ data "aws_iam_policy_document" "emr_on_eks" {
     resources = ["arn:${data.aws_partition.current.partition}:s3:::*"]
 
     actions = [
-      "s3:PutObject",
+      "s3:DeleteObject",
+      "s3:DeleteObjectVersion",
       "s3:GetObject",
       "s3:ListBucket",
-      "s3:DeleteObject",
-      "s3:DeleteObjectVersion"
+      "s3:PutObject",
     ]
   }
 
@@ -416,10 +416,10 @@ data "aws_iam_policy_document" "emr_on_eks" {
 
     actions = [
       "logs:CreateLogGroup",
-      "logs:PutLogEvents",
       "logs:CreateLogStream",
       "logs:DescribeLogGroups",
       "logs:DescribeLogStreams",
+      "logs:PutLogEvents",
     ]
   }
 }

modules/aws-eks-fargate-profiles/main.tf

@@ -77,8 +77,8 @@ data "aws_iam_policy_document" "cwlogs" {
     resources = ["*"]
 
     actions = [
-      "logs:CreateLogStream",
       "logs:CreateLogGroup",
+      "logs:CreateLogStream",
       "logs:DescribeLogStreams",
       "logs:PutLogEvents",
     ]

modules/aws-eks-self-managed-node-groups/data.tf

@@ -32,9 +32,9 @@ data "aws_iam_policy_document" "eks_windows_cni" {
 
     actions = [
       "ec2:DescribeInstances",
-      "ec2:DescribeTags",
-      "ec2:DescribeNetworkInterfaces",
       "ec2:DescribeInstanceTypes",
+      "ec2:DescribeNetworkInterfaces",
+      "ec2:DescribeTags",
     ]
   }
 }

modules/aws-eks-teams/data.tf

@@ -13,14 +13,14 @@ data "aws_iam_policy_document" "platform_team_eks_access" {
   statement {
     sid = "AllowPlatformTeamEKSAccess"
     actions = [
-      "eks:DescribeNodegroup",
-      "eks:ListNodegroups",
+      "eks:AccessKubernetesApi",
       "eks:DescribeCluster",
+      "eks:DescribeNodegroup",
       "eks:ListClusters",
-      "eks:AccessKubernetesApi",
-      "ssm:GetParameter",
+      "eks:ListFargateProfiles",
+      "eks:ListNodegroups",
       "eks:ListUpdates",
-      "eks:ListFargateProfiles"
+      "ssm:GetParameter",
     ]
     resources = [
       data.aws_eks_cluster.eks_cluster.arn

modules/kubernetes-addons/aws-ebs-csi-driver/main.tf

@@ -52,16 +52,16 @@ data "aws_iam_policy_document" "aws_ebs_csi_driver" {
     resources = ["*"]
 
     actions = [
-      "ec2:CreateSnapshot",
       "ec2:AttachVolume",
-      "ec2:DetachVolume",
-      "ec2:ModifyVolume",
+      "ec2:CreateSnapshot",
       "ec2:DescribeAvailabilityZones",
       "ec2:DescribeInstances",
       "ec2:DescribeSnapshots",
       "ec2:DescribeTags",
       "ec2:DescribeVolumes",
       "ec2:DescribeVolumesModifications",
+      "ec2:DetachVolume",
+      "ec2:ModifyVolume",
     ]
   }
 

modules/kubernetes-addons/aws-for-fluentbit/data.tf

@@ -16,10 +16,10 @@ data "aws_iam_policy_document" "irsa" {
     resources = ["arn:${var.addon_context.aws_partition_id}:logs:${var.addon_context.aws_region_name}:${var.addon_context.aws_caller_identity_account_id}:log-group:*"]
 
     actions = [
+      "logs:CreateLogGroup",
       "logs:CreateLogStream",
       "logs:DescribeLogGroups",
       "logs:DescribeLogStreams",
-      "logs:CreateLogGroup",
     ]
   }
 }
@@ -44,11 +44,11 @@ data "aws_iam_policy_document" "kms" {
     resources = ["*"]
 
     actions = [
-      "kms:Encrypt*",
       "kms:Decrypt*",
-      "kms:ReEncrypt*",
-      "kms:GenerateDataKey*",
       "kms:Describe*",
+      "kms:Encrypt*",
+      "kms:GenerateDataKey*",
+      "kms:ReEncrypt*",
     ]
 
     condition {

modules/kubernetes-addons/aws-load-balancer-controller/data.tf

@@ -5,30 +5,30 @@ data "aws_iam_policy_document" "aws_lb" {
     resources = ["*"]
 
     actions = [
-      "iam:CreateServiceLinkedRole",
       "ec2:DescribeAccountAttributes",
       "ec2:DescribeAddresses",
-      "ec2:DescribeInternetGateways",
       "ec2:DescribeAvailabilityZones",
-      "ec2:DescribeVpcs",
-      "ec2:DescribeVpcPeeringConnections",
-      "ec2:DescribeSubnets",
-      "ec2:DescribeSecurityGroups",
+      "ec2:DescribeCoipPools",
       "ec2:DescribeInstances",
+      "ec2:DescribeInternetGateways",
       "ec2:DescribeNetworkInterfaces",
+      "ec2:DescribeSecurityGroups",
+      "ec2:DescribeSubnets",
       "ec2:DescribeTags",
+      "ec2:DescribeVpcPeeringConnections",
+      "ec2:DescribeVpcs",
       "ec2:GetCoipPoolUsage",
-      "ec2:DescribeCoipPools",
-      "elasticloadbalancing:DescribeLoadBalancers",
-      "elasticloadbalancing:DescribeLoadBalancerAttributes",
-      "elasticloadbalancing:DescribeListeners",
       "elasticloadbalancing:DescribeListenerCertificates",
-      "elasticloadbalancing:DescribeSSLPolicies",
+      "elasticloadbalancing:DescribeListeners",
+      "elasticloadbalancing:DescribeLoadBalancerAttributes",
+      "elasticloadbalancing:DescribeLoadBalancers",
       "elasticloadbalancing:DescribeRules",
-      "elasticloadbalancing:DescribeTargetGroups",
+      "elasticloadbalancing:DescribeSSLPolicies",
+      "elasticloadbalancing:DescribeTags",
       "elasticloadbalancing:DescribeTargetGroupAttributes",
+      "elasticloadbalancing:DescribeTargetGroups",
       "elasticloadbalancing:DescribeTargetHealth",
-      "elasticloadbalancing:DescribeTags",
+      "iam:CreateServiceLinkedRole",
     ]
   }
 
@@ -38,23 +38,23 @@ data "aws_iam_policy_document" "aws_lb" {
     resources = ["*"]
 
     actions = [
-      "cognito-idp:DescribeUserPoolClient",
-      "acm:ListCertificates",
       "acm:DescribeCertificate",
-      "iam:ListServerCertificates",
+      "acm:ListCertificates",
+      "cognito-idp:DescribeUserPoolClient",
       "iam:GetServerCertificate",
-      "waf-regional:GetWebACL",
-      "waf-regional:GetWebACLForResource",
+      "iam:ListServerCertificates",
+      "shield:CreateProtection",
+      "shield:DeleteProtection",
+      "shield:DescribeProtection",
+      "shield:GetSubscriptionState",
       "waf-regional:AssociateWebACL",
       "waf-regional:DisassociateWebACL",
-      "wafv2:GetWebACL",
-      "wafv2:GetWebACLForResource",
+      "waf-regional:GetWebACL",
+      "waf-regional:GetWebACLForResource",
       "wafv2:AssociateWebACL",
       "wafv2:DisassociateWebACL",
-      "shield:GetSubscriptionState",
-      "shield:DescribeProtection",
-      "shield:CreateProtection",
-      "shield:DeleteProtection",
+      "wafv2:GetWebACL",
+      "wafv2:GetWebACLForResource",
     ]
   }
 
@@ -117,15 +117,15 @@ data "aws_iam_policy_document" "aws_lb" {
     effect = "Allow"
 
     resources = [
-      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:targetgroup/*/*",
-      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/net/*/*",
       "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/app/*/*",
+      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:targetgroup/*/*",
     ]
 
     actions = [
       "elasticloadbalancing:AddTags",
-      "elasticloadbalancing:RemoveTags",
       "elasticloadbalancing:DeleteTargetGroup",
+      "elasticloadbalancing:RemoveTags",
     ]
 
     condition {
@@ -165,8 +165,8 @@ data "aws_iam_policy_document" "aws_lb" {
 
     actions = [
       "ec2:AuthorizeSecurityGroupIngress",
-      "ec2:RevokeSecurityGroupIngress",
       "ec2:DeleteSecurityGroup",
+      "ec2:RevokeSecurityGroupIngress",
     ]
 
     condition {
@@ -200,8 +200,8 @@ data "aws_iam_policy_document" "aws_lb" {
 
     actions = [
       "elasticloadbalancing:CreateListener",
-      "elasticloadbalancing:DeleteListener",
       "elasticloadbalancing:CreateRule",
+      "elasticloadbalancing:DeleteListener",
       "elasticloadbalancing:DeleteRule",
     ]
   }
@@ -211,9 +211,9 @@ data "aws_iam_policy_document" "aws_lb" {
     effect = "Allow"
 
     resources = [
-      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:targetgroup/*/*",
-      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/net/*/*",
       "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/app/*/*",
+      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:loadbalancer/net/*/*",
+      "arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:targetgroup/*/*",
     ]
 
     actions = [
@@ -240,14 +240,14 @@ data "aws_iam_policy_document" "aws_lb" {
     resources = ["*"]
 
     actions = [
+      "elasticloadbalancing:DeleteLoadBalancer",
+      "elasticloadbalancing:DeleteTargetGroup",
       "elasticloadbalancing:ModifyLoadBalancerAttributes",
+      "elasticloadbalancing:ModifyTargetGroup",
+      "elasticloadbalancing:ModifyTargetGroupAttributes",
       "elasticloadbalancing:SetIpAddressType",
       "elasticloadbalancing:SetSecurityGroups",
       "elasticloadbalancing:SetSubnets",
-      "elasticloadbalancing:DeleteLoadBalancer",
-      "elasticloadbalancing:ModifyTargetGroup",
-      "elasticloadbalancing:ModifyTargetGroupAttributes",
-      "elasticloadbalancing:DeleteTargetGroup",
     ]
 
     condition {
@@ -263,8 +263,8 @@ data "aws_iam_policy_document" "aws_lb" {
     resources = ["arn:${var.addon_context.aws_partition_id}:elasticloadbalancing:*:*:targetgroup/*/*"]
 
     actions = [
-      "elasticloadbalancing:RegisterTargets",
       "elasticloadbalancing:DeregisterTargets",
+      "elasticloadbalancing:RegisterTargets",
     ]
   }
 
@@ -274,11 +274,11 @@ data "aws_iam_policy_document" "aws_lb" {
     resources = ["*"]
 
     actions = [
-      "elasticloadbalancing:SetWebAcl",
-      "elasticloadbalancing:ModifyListener",
       "elasticloadbalancing:AddListenerCertificates",
-      "elasticloadbalancing:RemoveListenerCertificates",
+      "elasticloadbalancing:ModifyListener",
       "elasticloadbalancing:ModifyRule",
+      "elasticloadbalancing:RemoveListenerCertificates",
+      "elasticloadbalancing:SetWebAcl",
     ]
   }
 }

modules/kubernetes-addons/aws-node-termination-handler/data.tf

@@ -24,7 +24,7 @@ data "aws_iam_policy_document" "irsa_policy" {
       "autoscaling:DescribeTags",
       "ec2:DescribeInstances",
       "sqs:DeleteMessage",
-      "sqs:ReceiveMessage"
+      "sqs:ReceiveMessage",
     ]
     resources = ["*"]
   }

modules/kubernetes-addons/aws-privateca-issuer/data.tf

@@ -5,7 +5,7 @@ data "aws_iam_policy_document" "aws_privateca_issuer" {
     actions = [
       "acm-pca:DescribeCertificateAuthority",
       "acm-pca:GetCertificate",
-      "acm-pca:IssueCertificate"
+      "acm-pca:IssueCertificate",
     ]
   }
 }

modules/kubernetes-addons/aws-vpc-cni/main.tf

@@ -56,9 +56,9 @@ data "aws_iam_policy_document" "ipv6_policy" {
     actions = [
       "ec2:AssignIpv6Addresses",
       "ec2:DescribeInstances",
-      "ec2:DescribeTags",
+      "ec2:DescribeInstanceTypes",
       "ec2:DescribeNetworkInterfaces",
-      "ec2:DescribeInstanceTypes"
+      "ec2:DescribeTags",
     ]
     resources = ["*"]
   }

modules/kubernetes-addons/cluster-autoscaler/main.tf

@@ -75,7 +75,7 @@ data "aws_iam_policy_document" "cluster_autoscaler" {
       "autoscaling:SetDesiredCapacity",
       "autoscaling:TerminateInstanceInAutoScalingGroup",
       "ec2:DescribeInstanceTypes",
-      "eks:DescribeNodegroup"
+      "eks:DescribeNodegroup",
     ]
     condition {
       test     = "StringEquals"

modules/kubernetes-addons/crossplane/data.tf

@@ -5,13 +5,13 @@ data "aws_iam_policy_document" "s3_policy" {
     resources = ["arn:${var.addon_context.aws_partition_id}:s3:::*"]
 
     actions = [
-      "s3:Get*",
-      "s3:Put*",
       "s3:CreateBucket",
-      "s3:ListBucket",
-      "s3:DeleteObject",
       "s3:DeleteBucket",
-      "s3:DeleteObjectVersion"
+      "s3:DeleteObject",
+      "s3:DeleteObjectVersion",
+      "s3:Get*",
+      "s3:ListBucket",
+      "s3:Put*",
     ]
   }