aws_iam_policy_document should combine redundant actions

[ghost]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Although there are some IAM actions in policies where you can't immediately tell that they overlap (e.g. sqs:Add* is a subset of sqs:*Permission*), there are some that obviously do overlap, like s3:Get* and s3:GetObject*. When using the source_json property for aws_iam_policy_document, it would be nice if terraform automatically excluded redundant rules like s3:GetObject* in this example. Because IAM policies do have a restricted size, this may actually make the difference when creating new policies.

Obviously, there are a lot of cases to this, but this could probably be done incrementally with a decent amount of improvement without a substantial decrease in performance.

New or Affected Resource(s)

• aws_iam_policy_document
• aws_iam_policy