feat: support inline policies

examples/complete/fixtures.us-east-2.tfvars

@@ -11,3 +11,5 @@ use_fullname = true
 principals = {
   "AWS" : ["*"]
 }
+
+inline_policy_enabled = true

examples/complete/main.tf

@@ -85,6 +85,7 @@ module "role" {
   policy_document_count = 2
   policy_description    = "Test IAM policy"
   role_description      = "Test IAM role"
+  inline_policy_enabled = var.inline_policy_enabled
 
   context = module.this.context
 }

examples/complete/variables.tf

@@ -12,3 +12,9 @@ variable "principals" {
   type        = map(list(string))
   description = "Map of service name as key and a list of ARNs to allow assuming the role as value (e.g. map(`AWS`, list(`arn:aws:iam:::role/admin`)))"
 }
+
+variable "inline_policy_enabled" {
+  type        = bool
+  description = "Whether or not to enable an inline policy instead of a reusable managed policy"
+  default     = false
+}

main.tf

@@ -44,34 +44,43 @@ resource "aws_iam_role" "default" {
   tags                 = var.tags_enabled ? module.this.tags : null
 }
 
+resource "aws_iam_role_policy" "default" {
+  count = module.this.enabled && var.policy_document_count > 0 && var.inline_policy_enabled ? 1 : 0
+
+  name = var.policy_name != "" && var.policy_name != null ? var.policy_name : module.this.id
+  role = join("", aws_iam_role.default[*].name)
+
+  policy = join("", data.aws_iam_policy_document.default[*].json)
+}
+
 data "aws_iam_policy_document" "default" {
   count                     = module.this.enabled && var.policy_document_count > 0 ? 1 : 0
   override_policy_documents = var.policy_documents
 }
 
 resource "aws_iam_policy" "default" {
-  count       = module.this.enabled && var.policy_document_count > 0 ? 1 : 0
+  count       = module.this.enabled && var.policy_document_count > 0 && !var.inline_policy_enabled ? 1 : 0
   name        = var.policy_name != "" && var.policy_name != null ? var.policy_name : module.this.id
   description = var.policy_description
-  policy      = join("", data.aws_iam_policy_document.default.*.json)
+  policy      = join("", data.aws_iam_policy_document.default[*].json)
   path        = var.path
   tags        = var.tags_enabled ? module.this.tags : null
 }
 
 resource "aws_iam_role_policy_attachment" "default" {
-  count      = module.this.enabled && var.policy_document_count > 0 ? 1 : 0
-  role       = join("", aws_iam_role.default.*.name)
-  policy_arn = join("", aws_iam_policy.default.*.arn)
+  count      = module.this.enabled && var.policy_document_count > 0 && !var.inline_policy_enabled ? 1 : 0
+  role       = join("", aws_iam_role.default[*].name)
+  policy_arn = join("", aws_iam_policy.default[*].arn)
 }
 
 resource "aws_iam_role_policy_attachment" "managed" {
   for_each   = module.this.enabled ? var.managed_policy_arns : []
-  role       = join("", aws_iam_role.default.*.name)
+  role       = join("", aws_iam_role.default[*].name)
   policy_arn = each.key
 }
 
 resource "aws_iam_instance_profile" "default" {
   count = module.this.enabled && var.instance_profile_enabled ? 1 : 0
   name  = module.this.id
-  role  = join("", aws_iam_role.default.*.name)
+  role  = join("", aws_iam_role.default[*].name)
 }

variables.tf

@@ -90,7 +90,13 @@ variable "path" {
 }
 
 variable "tags_enabled" {
-  type        = string
+  type        = bool
   description = "Enable/disable tags on IAM roles and policies"
   default     = true
 }
+
+variable "inline_policy_enabled" {
+  type        = bool
+  description = "Whether or not to enable an inline policy instead of a reusable managed policy"
+  default     = false
+}