Add minified_json to aws_iam_policy_document data source

[alexwilcox9]

Description

This PR adds a new attribute to the aws_iam_policy_document data source to enable producing smaller JSONs. AWS Service Control Policies have a character limit of 5120 characters and in many cases I have seen policies approaching this limit.

The current json attribute is padded which wastes characters. One way to solve this is to wrap the json attribute in the jsondecode and jsonencode functions as these don't pad the output.

Having this as a direct attribute from the data source seems more efficient and allows for cleaner terraform files.

Relations

References

https://docs.aws.amazon.com/organizations/latest/userguide/org_troubleshoot_policies.html#scptoolong

Output from Acceptance Testing

I haven't currently got access to an environment where I can run the tests but from running the provider locally I can see the length is smaller

data "aws_iam_policy_document" "example" {
  statement {
    sid = "1"

    actions = [
      "s3:ListAllMyBuckets",
      "s3:GetBucketLocation",
    ]

    resources = [
      "arn:aws:s3:::*",
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
    ]

    resources = [
      "arn:aws:s3:::bucketname",
    ]

    condition {
      test     = "StringLike"
      variable = "s3:prefix"

      values = [
        "",
        "home/",
        "home/&{aws:username}/",
      ]
    }
  }

  statement {
    actions = [
      "s3:*",
    ]

    resources = [
      "arn:aws:s3:::bucketname/home/&{aws:username}",
      "arn:aws:s3:::bucketname/home/&{aws:username}/*",
    ]
  }
}

output "json" {
  value = length(data.aws_iam_policy_document.example.json)
}

output "jsonmin" {
  value = length(data.aws_iam_policy_document.example.minified_json)
}

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

json = 722
jsonmin = 454

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

Welcome @alexwilcox9 👋

It looks like this is your first Pull Request submission to the Terraform AWS Provider! If you haven’t already done so please make sure you have checked out our CONTRIBUTOR guide and FAQ to make sure your contribution is adhering to best practice and has all the necessary elements in place for a successful approval.

Also take a look at our FAQ which details how we prioritize Pull Requests for inclusion.

Thanks again, and welcome to the community! 😃

[jar-b]

Hi @alexwilcox9 - thanks for your submission!

The AWS IAM quotas page indicates that whitespace isn't counted against the character limit for inline or managed policies.

IAM doesn't count white space when calculating the size of a policy against these limits.

Is there a use case outside of IAM which this minified variant of the resulting JSON is intended for?

[jar-b]

And to immediately contradict myself - the AWS Organizations quotas page states whitespace is not removed when using the AWS CLI or an SDK 🤦

Note: If you save the policy by using the AWS Management Console, extra white space (such as spaces and line breaks) between JSON elements and outside of quotation marks, is removed and not counted. If you save the policy using an SDK operation or the AWS CLI, then the policy is saved exactly as you provided and no automatic removal of characters occurs.

With that context, this seems like a valuable enhancement.

[jar-b]

LGTM 🎉

% make testacc PKG=iam TESTS=TestAccIAMPolicyDocumentDataSource_
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.22.2 test ./internal/service/iam/... -v -count 1 -parallel 20 -run='TestAccIAMPolicyDocumentDataSource_'  -timeout 360m

=== NAME  TestAccIAMPolicyDocumentDataSource_StatementPrincipalIdentifiers_multiplePrincipalsGov
    policy_document_data_source_test.go:393: skipping tests; current partition (aws) does not equal aws-us-gov
--- SKIP: TestAccIAMPolicyDocumentDataSource_StatementPrincipalIdentifiers_multiplePrincipalsGov (0.41s)
--- PASS: TestAccIAMPolicyDocumentDataSource_sourceListConflicting (4.75s)
--- PASS: TestAccIAMPolicyDocumentDataSource_sourceList (19.27s)
--- PASS: TestAccIAMPolicyDocumentDataSource_StatementPrincipalIdentifiers_stringAndSlice (21.24s)
--- PASS: TestAccIAMPolicyDocumentDataSource_sourcePolicyValidJSON (22.23s)
--- PASS: TestAccIAMPolicyDocumentDataSource_multipleConditionKeys (22.24s)
--- PASS: TestAccIAMPolicyDocumentDataSource_duplicateConditionKeys (22.40s)
--- PASS: TestAccIAMPolicyDocumentDataSource_sourceConflicting (22.43s)
--- PASS: TestAccIAMPolicyDocumentDataSource_noStatementOverride (22.43s)
--- PASS: TestAccIAMPolicyDocumentDataSource_duplicateSid (22.50s)
--- PASS: TestAccIAMPolicyDocumentDataSource_conditionWithBoolValue (22.54s)
--- PASS: TestAccIAMPolicyDocumentDataSource_singleConditionValue (22.62s)
--- PASS: TestAccIAMPolicyDocumentDataSource_noStatementMerge (22.64s)
--- PASS: TestAccIAMPolicyDocumentDataSource_StatementPrincipalIdentifiers_multiplePrincipals (22.64s)
--- PASS: TestAccIAMPolicyDocumentDataSource_basic (22.65s)
--- PASS: TestAccIAMPolicyDocumentDataSource_overrideList (22.70s)
--- PASS: TestAccIAMPolicyDocumentDataSource_override (22.70s)
--- PASS: TestAccIAMPolicyDocumentDataSource_version20081017 (25.89s)
--- PASS: TestAccIAMPolicyDocumentDataSource_overridePolicyDocumentValidJSON (26.75s)
--- PASS: TestAccIAMPolicyDocumentDataSource_source (27.32s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/iam        32.255s

[jar-b]

Thanks for your contribution, @alexwilcox9! 👍

[github-actions]

This functionality has been released in v5.49.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.