allow_encrypted_uploads_only overrides policy

[rajcheval]

If I create a new bucket and pass in a policy and setup allow_encrypted_uploads_only the policy is ignored and bucket policy only contains allow_encrypted_uploads_only related statements.

[darend]

One way to solve it: hashicorp/terraform-provider-aws#2890

[rajcheval]

Thanks @darend

I took a quick look at data source aws_iam_policy_document
It has 2 properties source_json and override_json
I am trying to figure out how to implement this.

If policy parameter is specified it will be used to set the soure_json.

Now if a user sets the property allow_encrypted_uploads_only I will set override_json.
If both source_json and override_json are set are their statements merged?
without reading the code or executing this I don't know if I have to set source_json, override_json and the final policy will combine the statements.

I will contribute the final solution back into the repo.

[darend]

Off hand Im not sure how to do it in this repo because aws_iam_policy_document.bucket_policy is optional. If it was always enabled, then you would do:

data "aws_iam_policy_document" "bucket_policy" {
  count = "${var.enabled == "true" ? 1 : 0}"

  source_json = "${var.policy}"

  statement {
    sid       = "DenyIncorrectEncryptionHeader"
    effect    = "Deny"

....

[jaymed]

Off hand Im not sure how to do it in this repo because aws_iam_policy_document.bucket_policy is optional. If it was always enabled, then you would do:

data "aws_iam_policy_document" "bucket_policy" {
  count = "${var.enabled == "true" ? 1 : 0}"

  source_json = "${var.policy}"

  statement {
    sid       = "DenyIncorrectEncryptionHeader"
    effect    = "Deny"

....

@darend Thanks for providing the clues for solving this issue. I've submitted a pull request (#49) which uses dynamic blocks to build out the aws_iam_policy_document.bucket_policy resource. The resource merges in the user policy via the source_json argument (as you mention above). I had to remove the s3_bucket policy argument to avoid conflicting updates to the bucket policy. The merged policy now provides both the user defined policy and the additional ssl/encryption policies.