frostmoln_iam_policy_attachment (Resource)

Attaches an IAM access policy (frostmoln_iam_policy) to a machine principal (an API key or workload identity) or a group. The attachment is immutable — changing any attribute detaches and re-attaches. Use one attachment resource per policy/principal pair.

Authoritative scope — who owns what on this resource, declared in internal/scopedecl and machine-checked against the schema.

Create-immutable — attachee_id, attachee_type, policy_id: the attachment is identified by its policy and attachee; changing one is a different attachment.

Example Usage

# Attach an IAM policy to a machine principal (an API key or workload identity)
# or a group. The attachment is immutable — changing any field re-attaches.
resource "frostmoln_iam_policy_attachment" "ci_key" {
  policy_id     = frostmoln_iam_policy.ci.id
  attachee_type = "api_key" # or "workload_identity" / "group"
  attachee_id   = frostmoln_api_key.ci.id
}

Schema

Required

• attachee_id (String) The identifier of the principal or group to attach the policy to.
• attachee_type (String) The kind of principal to attach to: api_key, workload_identity, or group.
• policy_id (String) The policy to attach.

Read-Only

• attached_at (String) The timestamp when the policy was attached.
• id (String) Synthetic identifier: policy_id/attachee_type/attachee_id.

Import

Import is supported using the following syntax:

The terraform import command can be used, for example:

# Attachments are imported by the composite id "policy_id/attachee_type/attachee_id".
terraform import frostmoln_iam_policy_attachment.ci_key <policy-id>/api_key/<attachee-id>