$ the-wire · showcase
Policy library fixes null errors and removes unmanageable checks
By RepoJournal · Filed · About HashiCorp
Five fixes across the prewritten Terraform policy library address null-value errors and delete policies that could not be managed via Terraform.
Prewritten Terraform policy fixes [1] resolve issues in backup, apigw, kms, and rds policies. The s3 read/write policies now use a single aws_s3_bucket resource policy that cross-references bucket ACL, policy, and public access block resources instead of two separate policies [2]. Codebuild, rds, ebs, and secretmanager fixes add "safer null-handling, more precise checks, tighten EBS state requirement, change how Secrets Manager rotations are matched", and remove two Secrets Manager policies because they are not terraform-manageable [3]. EC2 SSM-managed policies and their tests are deleted for the same reason, and many filter clauses that skipped resources when blocks were missing are removed [4]. A developing fix [5] adds targeted null checks to EKS, Redshift, EC2, and CloudFront policies, and every change removes checks that could not work from Terraform state alone.
Action items
- → Pull these fixes before generating SCP policies from the library hashicorp/prewritten-terraform-policy-library [immediate]
- → Audit use of Secrets Manager rotation policies and EC2 SSM policies, now removed hashicorp/prewritten-terraform-policy-library [plan]
References
- [1] fix: resolve issues in backup, apigw, kms, rds policies ↗ hashicorp/prewritten-terraform-policy-library
- [2] fix: modified s3 read/write, dynamo, dms policies ↗ hashicorp/prewritten-terraform-policy-library
- [3] fix: resolve issues in codebuild, rds, ebs, secretmanager policies ↗ hashicorp/prewritten-terraform-policy-library
- [4] fix: modified sagemaker, redshift, msk, ssm, ec and es policies ↗ hashicorp/prewritten-terraform-policy-library
- [5] Fix: eks redshift ec2 cf null errors ↗ hashicorp/prewritten-terraform-policy-library