Terraform iam_policy_document - diff. of resource vs. principal

2
votes

I would like to ask if someone knows the difference between a "resource" and a "principal", when creating an aws_iam_policy_document in terraform.

The terraform documentation has the following information:

  • resource: A list of resource ARNs that this statement applies to. This is required by AWS if used for an IAM policy.

  • principals: A nested configuration block (described below) specifying a resource (or resource pattern) to which this statement applies.

From reading the above two sentences, it looks like they have the same effect, even thought they might do different things.

On further research, I came accross this article, which explains the differences between identity-based and resource-based policies.

It seams to me that this might be the answer to my question. If so, from what I understand, resource is a "resource-based" policy, while principal is a "identity-based" policy. Is that correct?

If this is the case, my follow-up question is: can I can use both type of policies together to further restrict the access?

For example, if i have a resource policy on an S3 bucket granting complete public access, but than I add a identity-based policy for a single user, does this user become the only one who can access the bucket?

I appreciate your help, and will try to clarify anything that might be unclear.

1
terraformamazon-iam

1 Answers

1
votes

The Terraform documentation on this is a bit confusing. Prefer the AWS docs in this case. However, when TF refers to Principal, they do mean the same thing, i.e. who gets permissions. Who can be users, groups, roles and services.

However, a Principal isn't needed when you have a policy attached to an IAM user, group or role, because the user, group or role is the implied principal.

So why or when would you need a principal section? When the policy is attached to something that isn't inherently a user, group or role. For example, an S3 bucket policy.

HTH!