AWS IAM policies for running Terraform from an EC2 instance.

iam-terraform-create-policy.tf

resource "aws_iam_policy" "terraform_create_policy" {
    name = "terraform_create_policy"
    path = "/"
    policy = "${data.aws_iam_policy_document.terraform_create_policy.json}"
}

data "aws_iam_policy_document" "terraform_create_policy" {
    statement {
        sid = "1"
        actions = [
			"ec2:CreateNetworkAcl",
			"ec2:CreateNetworkAclEntry",
			"ec2:CreateNetworkInterface",
			"ec2:AttachNetworkInterface",
			"autoscaling:AttachLoadbalancers",
			"autoscaling:CreateAutoScalingGroup",
			"autoscaling:CreateLaunchConfiguration",
			"ec2:CreateVpc",
			"ec2:DescribeNetworkACLs",
			"ec2:DescribeRouteTables",
			"ec2:CreateVpc",
			"ec2:CreateVpcEndpoint",
			"ec2:CreateVpc",
			"ec2:CreateVpcPeeringConnection",
			"ec2:AcceptVpcPeeringConnection",
			"ec2:CreateSubnet",
			"ec2:CreateTags",
			"ec2:RunInstances",
			"ec2:MonitorInstances",
			"ec2:CreateSecurityGroup",
			"ec2:AuthorizeSecurityGroupEgress",
			"ec2:AuthorizeSecurityGroupIngress",
			"ec2:RevokeSecurityGroupEgress",
			"ec2:RevokeSecurityGroupIngress",
			"ec2:AuthorizeSecurityGroupEgress",
			"ec2:AuthorizeSecurityGroupIngress",
			"ec2:CreateInternetGateway",
			"ec2:AttachInternetGateway",
			"ec2:CreateRoute",
			"ec2:CreateRouteTable",
			"ec2:EnableVGWRoutePropagation",
			"ec2:AllocateAddress",
			"ec2:AssociateAddress",
			"ec2:AssociateRouteTable",
			"route53:CreateHealthCheck",
			"ec2:CreateVolume",
			"ec2:AttachVolume",
			"elasticloadbalancing:ApplySecurityGroupsToLoadbalancer",
			"elasticloadbalancing:ConfigureHealthCheck",
			"elasticloadbalancing:CreateLoadBalancer",
			"elasticloadbalancing:CreateLoadBalancerListeners",
			"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
			"elasticloadbalancing:AddTags",
			"iam:AddRoleToInstanceProfile",
			"iam:CreateInstanceProfile",
			"rds:AddTagsToResource",
			"iam:CreatePolicyVersion",
			"iam:PassRole"
        ]
        resources = [
            "*",
        ]
    }
}

iam-terraform-delete-policy.tf

resource "aws_iam_policy" "terraform_delete_policy" {
    name = "terraform_delete_policy"
    path = "/"
    policy = "${data.aws_iam_policy_document.terraform_delete_policy.json}"
}


data "aws_iam_policy_document" "terraform_delete_policy" {
    statement {
        sid = "1"
        actions = [
			"ec2:DeleteNetworkAcl",
			"ec2:DeleteNetworkAclEntry",
			"ec2:DetachNetworkInterface",
			"ec2:DeleteNetworkInterface",
			"autoscaling:DetachLoadbalancers",
			"autoscaling:DeleteAutoScalingGroup",
			"autoscaling:DeleteLaunchConfiguration",
			"ec2:DeleteVpc",
			"ec2:DeleteVpcEndpoints",
			"ec2:DeleteVpc",
			"ec2:DeleteVpc",
			"ec2:DeleteVpcPeeringConnection",
			"ec2:DeleteSubnet",
			"ec2:DeleteTags",
			"ec2:TerminateInstances",
			"ec2:UnmonitorInstances",
			"ec2:RevokeSecurityGroupIngress",
			"ec2:RevokeSecurityGroupEgress",
			"ec2:DeleteSecurityGroup",
			"ec2:RevokeSecurityGroupEgress",
			"ec2:RevokeSecurityGroupIngress",
			"ec2:DetachInternetGateway",
			"ec2:DeleteInternetGateway",
			"ec2:DeleteRoute",
			"ec2:DisableVGWRoutePropagation",
			"ec2:DisassociateRouteTable",
			"ec2:DeleteRouteTable",
			"ec2:ReleaseAddress",
			"ec2:DisassociateAddress",
			"ec2:DisassociateRouteTable",
			"route53:DeleteHealthCheck",
			"ec2:DeleteVolume",
			"ec2:DetachVolume",
			"elasticloadbalancing:DeleteLoadBalancer",
			"elasticloadbalancing:DeleteLoadBalancerListeners",
			"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
			"elasticloadbalancing:RemoveTags",
			"iam:DeleteInstanceProfile",
			"iam:RemoveRoleFromInstanceProfile"
        ]
        resources = [
            "*",
        ]
    }
}

iam-terraform-read-policy.tf

resource "aws_iam_policy" "terraform_read_policy" {
    name = "terraform_read_policy"
    path = "/"
    policy = "${data.aws_iam_policy_document.terraform_read_policy.json}"
}

data "aws_iam_policy_document" "terraform_read_policy" {
    statement {
        sid = "1"
        actions = [
			"ec2:DescribeNetworkAcls",
			"ec2:DescribeNetworkInterfaceAttributes",
			"ec2:DescribeNetworkInterfaces",
			"autoscaling:DescribeAutoScalingGroups",
			"elasticloadbalancing:DescribeInstanceHealth",
			"autoscaling:DescribeLaunchConfiguration",
			"ec2:DescribeSecurityGroups",
			"ec2:DescribeVpcAttribute",
			"ec2:DescribeVpc",
			"ec2:DescribeVpcEndpoints",
			"ec2:DescribeVpcPeeringConnections",
			"ec2:DescribeSubnets",
			"ec2:DescribeImages",
			"ec2:DescribeVolumes",
			"ec2:DescribeInstances",
			"ec2:DescribeSecurityGroups",
			"ec2:DescribeSecurityGroups",
			"ec2:DescribeSecurityGroups",
			"ec2:DescribeInternetGateways",
			"ec2:DescribeRouteTable",
			"ec2:DescribeAddresses",
			"ec2:DescribeRouteTable",
			"route53:GetHostedZone",
			"route53:ListResourceRecordSets",
			"route53:GetHealthCheck",
			"route53:ListTagsForResource",
			"ec2:DescribeVolumes",
			"ec2:DescribeVolumes",
			"elasticloadbalancing:DescribeLoadBalancerAttributes",
			"elasticloadbalancing:DescribeLoadBalancers",
			"elasticloadbalancing:DescribeTags",
			"iam:GetInstanceProfile",
			"iam:GetPolicy",
			"iam:GetRole",
			"rds:DescribeDBSubnetGroups",
			"elasticloadbalancing:DescribeTargetGroups",
			"iam:GetPolicyVersion",
			"elasticloadbalancing:DescribeTargetGroupAttributes",
			"rds:DescribeDBInstances",
			"elasticloadbalancing:DescribeListeners",
			"iam:ListEntitiesForPolicy",
			"elasticloadbalancing:DescribeRules",
			"iam:ListPolicyVersions"
        ]
        resources = [
            "*",
        ]
    }
}

iam-terraform-update-policy.tf

resource "aws_iam_policy" "terraform_update_policy" {
    name = "terraform_update_policy"
    path = "/"
    policy = "${data.aws_iam_policy_document.terraform_update_policy.json}"
}

data "aws_iam_policy_document" "terraform_update_policy" {
    statement {
        sid = "1"
        actions = [
			"ec2:ReplaceNetworkAclAssociation",
			"ec2:ModifyNetworkInterfaceAttribute",
			"autoscaling:UpdateAutoScalingGroup",
			"ec2:ModifyVpcAttribute",
			"ec2:ModifyVpcEndpoint",
			"ec2:ModifySubnetAttributes",
			"ec2:ModifyInstanceAttribute",
			"ec2:ReplaceRouteTableAssociation",
			"ec2:ReplaceRouteTableAssociation",
			"route53:ChangeResourceRecordSets",
			"route53:ChangeTagsForResource",
			"route53:UpdateHealthCheck",
			"elasticloadbalancing:ModifyLoadBalancerAttributes",
			"rds:AddTagsToResource"
        ]
        resources = [
            "*",
        ]
    }
}