dynamic-block.tf

# iam_policy_statements = {
#    MountTarget = {
#      effect = "Allow"
#      principals = [
#        {
#          "type"        = "AWS",
#          "identifiers" = ["*"],
#        }
#      ]
#      actions = [
#        "elasticfilesystem:ClientRootAccess",
#        "elasticfilesystem:ClientWrite",
#        "elasticfilesystem:ClientMount",
#        "elasticfilesystem:Describe*",
#      ],
#      resources = [
#        "arn:aws:elasticfilesystem:us-west-2:897347678622:file-system/fs-*"
#      ]
#      conditions = [
#        {
#          "test"     = "Bool",
#          "variable" = "elasticfilesystem:AccessedViaMountTarget",
#          "values" = [
#            "true"
#          ],
#        }
#      ]
#    }
#    AccessPoint = {
#      effect = "Allow"
#      principals = [
#        {
#          "type" = "AWS",
#          "identifiers" = [
#            "arn:aws:iam::119428626494:root"
#          ],
#        }
#      ]
#      actions = [
#        "elasticfilesystem:ClientWrite",
#        "elasticfilesystem:ClientMount",
#        "elasticfilesystem:Describe*",
#      ],
#      resources = [
#        "arn:aws:elasticfilesystem:us-west-2:*:file-system/fs-*"
#      ]
#      conditions = [
#        {
#          "test"     = "StringEquals",
#          "variable" = "elasticfilesystem:AccessPointArn",
#          "values" = [
#            "arn:aws:elasticfilesystem:us-west-2:*:access-point/fsap-*"
#          ],
#        }
#      ]
#    }
#    DescribeAccess = {
#      effect = "Allow"
#      principals = [
#        {
#          "type" = "AWS",
#          "identifiers" = [
#            "arn:aws:iam::119428626494:root"
#          ],
#        }
#      ]
#      actions = [
#        "elasticfilesystem:Describe*",
#      ],
#      resources = [
#        "arn:aws:elasticfilesystem:us-west-2:*:file-system/fs-*"
#      ]
#    }
#  }

resource "aws_efs_file_system_policy" "policy" {
  file_system_id = aws_efs_file_system.efs.id
  count          = length(var.iam_policy_statements) > 0 ? 1 : 0
  policy         = join("", data.aws_iam_policy_document.efs.*.json)
}

data "aws_iam_policy_document" "efs" {
  count = length(var.iam_policy_statements) > 0 ? 1 : 0
  dynamic "statement" {
    for_each = try(flatten(var.iam_policy_statements), var.iam_policy_statements)
    content {
      sid       = lookup(statement.value, "sid", statement.key)
      effect    = lookup(statement.value, "effect", null)
      actions   = lookup(statement.value, "actions", null)
      resources = lookup(statement.value, "resources", null)
      dynamic "principals" {
        for_each = lookup(statement.value, "principals", [])
        content {
          type        = principals.value.type
          identifiers = principals.value.identifiers
        }
      }
      dynamic "condition" {
        for_each = lookup(statement.value, "conditions", [])
        content {
          test     = condition.value.test
          variable = condition.value.variable
          values   = condition.value.values
        }
      }
    }
  }
}