0

I would like to be able to see the JSON of a data resource (like a policy document) on the plan. Currently these type of resources only "renders" during the apply.

I want to know if there is a way to see it before run the terraform apply.

Here is my code:

data "aws_iam_policy_document" "my_policy" {
  statement {
    sid = "S3"
    effect = "Allow"
    actions = ["s3:*"]
    resources = [
      aws_s3_bucket.some-bucket.arn,
      "arn:aws:s3:::another-bucket/*",
      "arn:aws:s3:::another-bucket/"
    ]
  }
  statement {
    sid = "CloudWatch"
    effect = "Allow"
    actions = ["logs:*"]
    resources = [
      aws_cloudwatch_log_group.some_lambda.arn,
      "arn:aws:logs:us-east-1:123456789123:log-group:/some/log/group:*",
      "arn:aws:logs:us-east-1:123456789123:log-group:/some/log/group"
    ]
  }
}
2
  • Could you provide the code? did you use output?
    – palvarez
    Feb 27, 2023 at 13:55
  • Sure, I just updated the description. And no, I never used the terraform output. In fact, it is the first time I heard about it.
    – Arrow Root
    Feb 27, 2023 at 20:03

1 Answer 1

1

Terraform will read from a data resource during the plan phase if and only if the entire configuration of the data resource is known during the planning phase.

In your case you have references to both aws_s3_bucket.some-bucket.arn and aws_cloudwatch_log_group.some_lambda.arn, and I suspect that neither of those values are known during planning because the remote API decides the ARN for an object as part of creating it.

Therefore the only way to see this policy during planning would be for those two objects to have already been created and so their ARNs already be known from a previous run.

One way to achieve that would be to initially apply only part of your configuration just to get those objects created:

terraform apply -target=aws_s3_bucket.some-bucket -target=aws_cloudwatch_log_group.some_lambda

Terraform should propose to create those two objects and anything else they depend on, but will not yet read the data resource or anything else that depends on it. If you accept that plan and allow Terraform to create those objects, then you can subsequently run terraform apply as normal and Terraform should then be able to read this data resource during the second planning step and so show you the final value of this policy with the two ARNs already inserted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .