<p>The note callout at the top of <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" rel="nofollow noreferrer">the <code>aws_iam_policy_document</code> documentation</a> explains this syntax:</p>
<blockquote>
<p><strong>Note:</strong> AWS's IAM policy document syntax allows for replacement of <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html" rel="nofollow noreferrer">policy variables</a> within a statement using <code>${...}</code>-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use <code>&amp;{...}</code> notation for interpolations that should be processed by AWS rather than by Terraform.</p>
</blockquote>
<p>In other words, this is a special syntax implemented as a special case inside the <code>hashicorp/aws</code> Terraform provider to make it easier to use the IAM policy interpolation syntax without conflicting with Terraform's own template interpolation syntax. The provider will automatically replace <code>&amp;{</code> with <code>${</code> while it is rendering the final policy document.</p>

CC BY-SA 4.0
2023-06-17T01:00:08.130Z
2023-06-17T01:00:08.130Z
Martin Atkins
<p>I coudn't find meaning of <code>&amp;</code> sign in Terraform or/and AWS IAM policy. There is an example in <code>Data Source: aws_iam_policy_document</code> (<a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" rel="nofollow noreferrer">docs</a>) where you can see <code>Basic Example</code> (<a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#basic-example" rel="nofollow noreferrer">docs</a>, <a href="https://github.com/hashicorp/terraform-provider-aws/blob/5575f0cb17a8aa4c71b8359ccd80c7222b1de70c/website/docs/d/iam_policy_document.html.markdown?plain=1#L65-L66" rel="nofollow noreferrer">github source</a>):</p>
<pre><code>data &quot;aws_iam_policy_document&quot; &quot;example&quot; {
  (..)

  statement {
    actions = [
      &quot;s3:*&quot;,
    ]

    resources = [
      &quot;arn:aws:s3:::${var.s3_bucket_name}/home/&amp;{aws:username}&quot;,
      &quot;arn:aws:s3:::${var.s3_bucket_name}/home/&amp;{aws:username}/*&quot;,
    ]
  }
}
</code></pre>
<p>I cound't find the meaning of <code>&amp;{aws:username}</code>. I'd try to look up in AWS IAM documentation but there is only explanation how to use variables with dollar (<code>$</code>):</p>
<blockquote>
<p><em>The variable is marked using a $ prefix followed by a pair of curly braces ({ }).</em></p>
</blockquote>
<p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-using-variables" rel="nofollow noreferrer">Source</a></p>
<p>Question: What does <code>&amp;</code> character mean in above example?</p>

<amazon-web-services><terraform>
& (ampersand) in Terraform string or/and AWS IAM policy
sobi3ch
# & (ampersand) in Terraform string or/and AWS IAM policy

(Asked by: username_0 on 2023-06-14)

I coudn't find meaning of & sign in Terraform or/and AWS IAM policy. There is an example in Data Source: aws_iam_policy_document (docs) where you can see Basic Example (docs, github source):
data "aws_iam_policy_document" "example" {
  (..)

  statement {
    actions = [
      "s3:*",
    ]

    resources = [
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
    ]
  }
}

I cound't find the meaning of &{aws:username}. I'd try to look up in AWS IAM documentation but there is only explanation how to use variables with dollar ($):

The variable is marked using a $ prefix followed by a pair of curly braces ({ }).

Source
Question: What does & character mean in above example?

**Tags:** amazon-web-services, terraform


---

## 1 answers

### Answer by username_1 on 2023-06-17. Score: 2

The note callout at the top of [the `aws_iam_policy_document` documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) explains this syntax:

> **Note:** AWS's IAM policy document syntax allows for replacement of [policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html) within a statement using `${...}`-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use `&{...}` notation for interpolations that should be processed by AWS rather than by Terraform.

In other words, this is a special syntax implemented as a special case inside the `hashicorp/aws` Terraform provider to make it easier to use the IAM policy interpolation syntax without conflicting with Terraform's own template interpolation syntax. The provider will automatically replace `&{` with `${` while it is rendering the final policy document.


---

