diff --git a/README.md b/README.md
index 974cc45..7189ba2 100644
--- a/README.md
+++ b/README.md
@@ -40,30 +40,22 @@ The following input variables are required:
### [policies](#input\_policies)
-Description: List of policy configurations
+Description: List of policies with their details
Type:
```hcl
list(object({
name = string
- description = string
- statements = string # Path to the JSON file containing policy statements
- target_ids = list(string) # List of target account IDs or OU IDs
+ file = string
+ target_ids = list(string)
+ description = string # Ensure this is included
}))
```
## Optional Inputs
-The following input variables are optional (have default values):
-
-### [tags](#input\_tags)
-
-Description: Tags to apply to all resources created in this module
-
-Type: `map(string)`
-
-Default: `{}`
+No optional inputs.
diff --git a/main.tf b/main.tf
index 3ea6d7a..dee4464 100644
--- a/main.tf
+++ b/main.tf
@@ -1,40 +1,17 @@
-# Loop over each policy to create policy documents dynamically
-data "aws_iam_policy_document" "scp_policies" {
- for_each = { for p in var.policies : p.name => p }
-
- dynamic "statement" {
- for_each = jsondecode(file(each.value.statements))
- content {
- sid = lookup(statement.value, "Sid", null)
- effect = lookup(statement.value, "Effect", "Deny")
- actions = statement.value.Action
- resources = [lookup(statement.value, "Resource", "*")]
-
- dynamic "condition" {
- for_each = lookup(statement.value, "Condition", {})
- content {
- test = condition.key
- variable = condition.value[0]
- values = condition.value[1]
- }
- }
- }
- }
-}
-
-# Create policies with tags
+# Create an AWS Organization policy for each policy template
resource "aws_organizations_policy" "scp" {
- for_each = data.aws_iam_policy_document.scp_policies
- name = each.value.name
+ for_each = { for policy in var.policies : policy.name => policy }
+
+ name = each.key
description = each.value.description
- content = each.value.json
- tags = var.tags
+ content = templatefile(lookup(each.value, "file"), {})
}
-# Attach policies to targets with tags
resource "aws_organizations_policy_attachment" "attach_scp" {
- for_each = { for p in var.policies : p.name => p }
- count = length(each.value.target_ids)
- policy_id = aws_organizations_policy.scp[each.key].id
- target_id = each.value.target_ids[count.index]
-}
\ No newline at end of file
+ for_each = {
+ for policy in aws_organizations_policy.scp :
+ policy.name => policy
+ }
+ policy_id = each.value.id
+ target_id = flatten([for p in var.policies : p.target_ids if p.name == each.key])[0]
+}
diff --git a/variables.tf b/variables.tf
index c111729..e8deaf3 100644
--- a/variables.tf
+++ b/variables.tf
@@ -1,15 +1,9 @@
variable "policies" {
- description = "List of policy configurations"
+ description = "List of policies with their details"
type = list(object({
name = string
+ file = string
+ target_ids = list(string)
description = string
- statements = string # Path to the JSON file containing policy statements
- target_ids = list(string) # List of target account IDs or OU IDs
}))
}
-
-variable "tags" {
- description = "Tags to apply to all resources created in this module"
- type = map(string)
- default = {}
-}