<p>Yes, Terraform will detect drift in IAM policies.</p>
<p>Here is my starting point, a policy that allows full S3 and SQS access to specific resources.</p>
<pre><code>data &quot;aws_iam_policy_document&quot; &quot;task&quot; {
  statement {
    effect  = &quot;Allow&quot;
    actions = [&quot;sqs:*&quot;]
    resources = [
      aws_sqs_queue.my-queue.arn
    ]
  }

  statement {
    effect  = &quot;Allow&quot;
    actions = [&quot;s3:*&quot;]
    resources = [
      &quot;${aws_s3_bucket.my_bucket.arn}&quot;,
      &quot;${aws_s3_bucket.my_bucket.arn}/*&quot;,
    ]
  }
}

resource &quot;aws_iam_policy&quot; &quot;task_role&quot; {
  name   = &quot;my-task-policy&quot;
  policy = data.aws_iam_policy_document.task.json
}
</code></pre>
<p>I then manually added <code>ec2:DescribeInstances</code> to this policy via the AWS management console.</p>
<p>To test whether it was detected or not, I ran <code>terraform apply -target aws_iam_policy.task_role</code></p>
<pre><code>An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.task_role will be updated in-place
  ~ resource &quot;aws_iam_policy&quot; &quot;task_role&quot; {
        arn    = &quot;arn:aws:iam::111111111111:policy/my-task-policy&quot;
        id     = &quot;arn:aws:iam::111111111111:policy/my-task-policy&quot;
        name   = &quot;my-task-policy&quot;
        path   = &quot;/&quot;
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ... REDACTED...
                  - {
                      - Action   = &quot;ec2:DescribeInstances&quot;
                      - Effect   = &quot;Allow&quot;
                      - Resource = &quot;*&quot;
                      - Sid      = &quot;VisualEditor0&quot;
                    },
                ]
                Version   = &quot;2012-10-17&quot;
            }
        )
    }

Plan: 0 to add, 1 to change, 0 to destroy.
</code></pre>
<p>So Terraform correctly detected the drift.</p>

CC BY-SA 4.0
2020-06-30T23:45:13.417Z
2020-06-30T23:45:13.417Z
Woodland
<p>I know that Terraform dose some checks before the plan and can detect some changes but not others such as detecting changes to variables on a lambda but not detecting a new secret in a secret manager.</p>
<p>Are changes to the IAM policy something it detects?</p>

<amazon-web-services><terraform>
Are manual changes to an aws IAM policy detected by Terraform plan?
doug
# Are manual changes to an aws IAM policy detected by Terraform plan?

(Asked by: username_0 on 2020-06-30)

I know that Terraform dose some checks before the plan and can detect some changes but not others such as detecting changes to variables on a lambda but not detecting a new secret in a secret manager.

Are changes to the IAM policy something it detects?

**Tags:** amazon-web-services, terraform


---

## 1 answers

### Answer by username_1 on 2020-06-30. Score: 3 | Accepted answer

Yes, Terraform will detect drift in IAM policies.
Here is my starting point, a policy that allows full S3 and SQS access to specific resources.
data "aws_iam_policy_document" "task" {
  statement {
    effect  = "Allow"
    actions = ["sqs:*"]
    resources = [
      aws_sqs_queue.my-queue.arn
    ]
  }

  statement {
    effect  = "Allow"
    actions = ["s3:*"]
    resources = [
      "${aws_s3_bucket.my_bucket.arn}",
      "${aws_s3_bucket.my_bucket.arn}/*",
    ]
  }
}

resource "aws_iam_policy" "task_role" {
  name   = "my-task-policy"
  policy = data.aws_iam_policy_document.task.json
}

I then manually added ec2:DescribeInstances to this policy via the AWS management console.
To test whether it was detected or not, I ran terraform apply -target aws_iam_policy.task_role
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_iam_policy.task_role will be updated in-place
  ~ resource "aws_iam_policy" "task_role" {
        arn    = "arn:aws:iam::111111111111:policy/my-task-policy"
        id     = "arn:aws:iam::111111111111:policy/my-task-policy"
        name   = "my-task-policy"
        path   = "/"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                  ... REDACTED...
                  - {
                      - Action   = "ec2:DescribeInstances"
                      - Effect   = "Allow"
                      - Resource = "*"
                      - Sid      = "VisualEditor0"
                    },
                ]
                Version   = "2012-10-17"
            }
        )
    }

Plan: 0 to add, 1 to change, 0 to destroy.

So Terraform correctly detected the drift.


---

