如何列出执行 Terraform 应用所需的所有 AWS IAM 操作？

Question

I have about 30 terraform files which have Infra code for aws. AWS resource action operations are required to terraform apply in this files.

I want to find all EC2 operations used in these files like "DescribeInstances", "TerminateInstance"...etc. similarly for other aws resources.

The idea here is to granularize the policy in AWS by finding all AWS resource used in this file and action performed.

How do I list all AWS IAM actions required to perform a Terraform apply?

Answer 1

I am assuming you need a tool that determines the least IAM privileges required for your AWS Provider for Terraform.

This tool looks suitable: https://github.com/scottwinkler/terraform-policymaker

To run it you need to:

1. build it:

    go build

2. execute it with a path to the folder where you run terraform apply:

    ./terraform-policymaker -path=/path/to/where/you/terraform/apply/

It should output a list of all IAM actions required to execute your plan.