From 9ac93803873bcf11f8c7769078d952a4a0374747 Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Sun, 7 Jan 2024 12:58:16 +0000
Subject: [PATCH] Restructure state IAM to use separate role

---
 terraform/state.tf | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

diff --git a/terraform/state.tf b/terraform/state.tf
index 760fe8c..638d318 100644
--- a/terraform/state.tf
+++ b/terraform/state.tf
@@ -20,8 +20,8 @@ resource "aws_s3_bucket" "tfstate" {
 
 }
 
-resource "aws_iam_user_policy" "terraform" {
-  name = "terraform"
+resource "aws_iam_user_policy" "modify-terraform-user" {
+  name = "modify-terraform-user"
   user = aws_iam_user.terraform.name
 
   policy = <<EOF
@@ -29,13 +29,26 @@ resource "aws_iam_user_policy" "terraform" {
     "Version": "2012-10-17",
     "Statement": [
         {
-            "Sid": "VisualEditor0",
+            "Sid": "ModifyTerraformUser",
             "Effect": "Allow",
             "Action": "iam:*",
-            "Resource": "${aws_iam_user.terraform.arn}"
-        },
+            "Resource": "*"
+        }
+    ]
+}
+EOF
+}
+
+
+resource "aws_iam_policy" "terraform_state" {
+  name = "terraform-state"
+
+  policy = <<EOF
+{
+    "Version": "2012-10-17",
+    "Statement": [
         {
-            "Sid": "VisualEditor1",
+            "Sid": "TerraformState",
             "Effect": "Allow",
             "Action": "s3:*",
             "Resource": [
@@ -47,3 +60,12 @@ resource "aws_iam_user_policy" "terraform" {
 }
 EOF
 }
+
+resource "aws_iam_user_policy_attachment" "terraform-state" {
+  for_each = toset([
+    aws_iam_user.terraform.name
+  ])
+
+  user       = each.key
+  policy_arn = aws_iam_policy.terraform_state.arn
+}