Exclusive management of inline & managed policies for IAM users

[YakDriver]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Descends from #4426

Description

Add feature to revert out-of-band changes to attached (managed) and inline policies associated with an IAM user.

New or Affected Resource(s)

• aws_iam_user

Potential Terraform Configuration

resource "aws_iam_user" "example" {
  name          = "yak_user"
  inline_policy = []
}

resource "aws_iam_user" "example" {
  name = "yak_user"

  inline_policy {
    name = "my_inline_policy"

    policy = <<EOF
{
  "Statement": [
    {
      "Action": [
        "ec2:Describe*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "2012-10-17"
}
EOF
  }

  inline_policy {
    name   = "policy-8675309"
    policy = data.aws_iam_policy_document.inline_policy.json
  }
}

resource "aws_iam_user" "example" {
  name                = "yak_user"
  managed_policy_arns = [aws_iam_policy.policy_one.arn, aws_iam_policy.policy_two.arn]
}

References

• Feature request: Exclusive policy attachment list for users, groups, and roles #4426
• resource/aws_iam_role: Add exclusive list support for a role's inline and managed policies #5904
• Exclusive management of inline & managed policies for IAM roles #17510
• Exclusive management of inline & managed policies for IAM groups #17511

[ChaseFreeman17]

I would love to see this prioritized higher, until this is implemented drift will not show when managed policies or inline policies are attached to a IAM User outside of Terraform.

Basically if we see "aws_iam_user_policy_attachment" resource block we consider that as risk to our IaC as it will not drift properly.

I think the implementation of #17510 is exactly what is needed for users.