Module files for feedback https://github.com/terraform-providers/terraform-provider-aws/issues/438

main.tf

data "template_file" "sts_assume_role" {
  template = "${file("${path.module}/templates/policies/sts-assume-role.json")}"

  vars {
    sts_external_id = "${var.sts_external_id}"
  }
}

resource "aws_iam_role" "main" {
  name               = "DatadogAWSIntegrationRole"
  description        = "IAM role for DatadogAWSIntegrationPolicy"
  assume_role_policy = "${data.template_file.sts_assume_role.rendered}"
}

resource "aws_iam_role_policy" "main" {
  name   = "DatadogAWSIntegrationPolicy"
  role   = "${aws_iam_role.main.id}"
  policy = "${file("${path.module}/templates/policies/datadog-aws-integration.json")}"
}

sts-assume-role.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "AWS": "464622532012"
      },
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "${sts_external_id}"
        }
      },
      "Effect": "Allow"
    }
  ]
}