frostmoln_iam_policy (Resource)

Manages a reusable IAM access policy. A policy is a set of allow/deny rules over operations, targets (FRNs) and constraints; attach it to an API key, workload identity, or group with frostmoln_iam_policy_attachment. The policy is owned by the tenant resolved from the provider credential. Authoring requires an fm CLI / OIDC session — a machine token may not author or attach a policy.

Example Usage

# A reusable IAM access policy. Compose the document with the
# frostmoln_iam_policy_document data source, then attach the policy to a
# principal with frostmoln_iam_policy_attachment.
resource "frostmoln_iam_policy" "ci" {
  name        = "ci-compute-operator"
  description = "CI pipeline: create/read compute from the office network, never delete"
  document    = data.frostmoln_iam_policy_document.ci.json
}

Schema

Required

• document (String) The access-policy document as a JSON string ({"schemaVersion":"1","rules":[...]}). Compose it with the frostmoln_iam_policy_document data source rather than hand-writing it. The server validates operations against the append-only catalog, requires the region segment of every target FRN to be * (region-scoped targets are not supported yet), and rejects a malformed document. A hand-written or file()-loaded document is only checked at apply time; the data source catches these at plan time.
• name (String) The name of the policy.

Optional

• description (String) A description of the policy.

Read-Only

• authored_by (String) The user that authored the policy (server-set).
• created_at (String) The timestamp when the policy was created.
• id (String) The unique identifier of the policy.
• tenant_id (String) The owning tenant (server-set from the auth context).
• updated_at (String) The timestamp when the policy was last updated.
• version (Number) The policy version, incremented by the server on each update.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# IAM policies are imported by their id.
terraform import frostmoln_iam_policy.ci <policy-id>