frostmoln_iam_policy (Resource)

Manages a reusable IAM access policy. A policy is a set of allow/deny rules over operations, targets (FRNs) and constraints; attach it to an API key, workload identity, or group with frostmoln_iam_policy_attachment. The policy is owned by the provider's selected tenant (tenant_id, else the credential's default). Authoring requires an fm CLI / OIDC session — a machine token may not author or attach a policy.

~> Upgrade note. Before provider v0.37.9 this resource ignored tenant_id and always acted on the credential's home tenant. If your configuration sets a non-home tenant_id, existing policies live in the HOME tenant: the first plan after upgrading reads a 404, drops them from state and proposes a create in the selected tenant, leaving the originals orphaned and no longer managed. Either terraform state rm + re-import them against the selected tenant, or point tenant_id at the home tenant to keep managing them where they are.

Authoritative scope. Every configurable attribute of this resource is enacted and reconciled: the platform applies it and a refresh reads the truth back. No attribute forces replacement, and no platform-invented default attaches. Declared in internal/scopedecl, machine-checked against the schema.

Example Usage

# A reusable IAM access policy. Compose the document with the
# frostmoln_iam_policy_document data source, then attach the policy to a
# principal with frostmoln_iam_policy_attachment.
resource "frostmoln_iam_policy" "ci" {
  name        = "ci-compute-operator"
  description = "CI pipeline: create/read compute from the office network, never delete"
  document    = data.frostmoln_iam_policy_document.ci.json
}

Schema

Required

• document (String) The access-policy document as a JSON string ({"schemaVersion":"1","rules":[...]}). Compose it with the frostmoln_iam_policy_document data source rather than hand-writing it. The server validates operations against the append-only catalog, requires the region segment of every target FRN to be * (region-scoped targets are not supported yet), and rejects a malformed document. A hand-written or file()-loaded document is only checked at apply time; the data source catches these at plan time.
• name (String) The name of the policy.

Optional

• description (String) A description of the policy.

Read-Only

• authored_by (String) The user that authored the policy (server-set).
• created_at (String) The timestamp when the policy was created.
• id (String) The unique identifier of the policy.
• tenant_id (String) The owning tenant (server-set; the provider's tenant_id selects it).
• updated_at (String) The timestamp when the policy was last updated.
• version (Number) The policy version, incremented by the server on each update.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# IAM policies are imported by their id.
terraform import frostmoln_iam_policy.ci <policy-id>