Allow use of existing policy

[reisingerf]

Rather than creating a new policy form a referenced policy document, allow the use of an existing policy by specifying it's ARN.
This not only allows the re-use of an existing policy, but also the control over other aws_iam_policy arguments like path and description.

[raymondbutcher]

Hi @reisingerf , thanks for the PR but this change would break a bunch of places where I'm using this. Here is an example of my usage:

module "lambda" {
  source = "../../../modules/tf-aws-lambda"

  function_name = "deployment-build"
  description   = "Deployment build task"
  handler       = "lambda.lambda_handler"
  runtime       = "python3.6"
  timeout       = 300

  source_path = "${path.module}/lambda.py"

  attach_policy = true
  policy        = "${data.aws_iam_policy_document.lambda.json}"

  environment {
    variables {
      CODEBUILD_PROJECT_NAME = "${aws_codebuild_project.ami.name}"
      SOURCE_BUCKET          = "${var.source_bucket}"
      SOURCE_KEY             = "${var.source_key}"
      SLACK_URLS             = "${jsonencode(var.slack_urls)}"
    }
  }
}

data "aws_iam_policy_document" "lambda" {
  statement {
    effect = "Allow"

    actions = [
      "autoscaling:DescribeAutoScalingGroups",
      "ec2:DescribeImages",
    ]

    resources = [
      "*",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "s3:GetObject",
    ]

    resources = [
      "arn:aws:s3:::${var.source_bucket}/${var.source_key}",
    ]
  }

  statement {
    effect = "Allow"

    actions = [
      "codebuild:StartBuild",
    ]

    resources = [
      "${aws_codebuild_project.ami.id}",
    ]
  }
}

I like it because the module deals with the policy resources and I just have to pass in the policy JSON. Your change would force us to create a bunch of policies to hold the JSON but I'd rather let the module do that.

Could you implement your change in a way that doesn't break existing usage? Perhaps a new policy_arns or attach_policy_arns list variable?

[reisingerf]

I tried to convert my changes into an alternative that leaves the original version intact. Does this look better?

[reisingerf]

Sorry, for the long silence! I've completely been side tracked. I've some spare time now, so came back to it.
Happy for any comments!

[ssen1]

what's the status on this?