Answers: <p>Yes, Terraform will detect drift in IAM policies.</p>
  <p>Here is my starting point, a policy that allows full S3 and SQS access to specific resources.</p>
  <pre><code>data &quot;aws_iam_policy_document&quot; &quot;task&quot; {
    statement {
      effect  = &quot;Allow&quot;
      actions = [&quot;sqs:*&quot;]
      resources = [
        aws_sqs_queue.my-queue.arn
      ]
    }
  
    statement {
      effect  = &quot;Allow&quot;
      actions = [&quot;s3:*&quot;]
      resources = [
        &quot;${aws_s3_bucket.my_bucket.arn}&quot;,
        &quot;${aws_s3_bucket.my_bucket.arn}/*&quot;,
      ]
    }
  }
  
  resource &quot;aws_iam_policy&quot; &quot;task_role&quot; {
    name   = &quot;my-task-policy&quot;
    policy = data.aws_iam_policy_document.task.json
  }
  </code></pre>
  <p>I then manually added <code>ec2:DescribeInstances</code> to this policy via the AWS management console.</p>
  <p>To test whether it was detected or not, I ran <code>terraform apply -target aws_iam_policy.task_role</code></p>
  <pre><code>An execution plan has been generated and is shown below.
  Resource actions are indicated with the following symbols:
    ~ update in-place
  
  Terraform will perform the following actions:
  
    # aws_iam_policy.task_role will be updated in-place
    ~ resource &quot;aws_iam_policy&quot; &quot;task_role&quot; {
          arn    = &quot;arn:aws:iam::111111111111:policy/my-task-policy&quot;
          id     = &quot;arn:aws:iam::111111111111:policy/my-task-policy&quot;
          name   = &quot;my-task-policy&quot;
          path   = &quot;/&quot;
        ~ policy = jsonencode(
            ~ {
                ~ Statement = [
                    ... REDACTED...
                    - {
                        - Action   = &quot;ec2:DescribeInstances&quot;
                        - Effect   = &quot;Allow&quot;
                        - Resource = &quot;*&quot;
                        - Sid      = &quot;VisualEditor0&quot;
                      },
                  ]
                  Version   = &quot;2012-10-17&quot;
              }
          )
      }
  
  Plan: 0 to add, 1 to change, 0 to destroy.
  </code></pre>
  <p>So Terraform correctly detected the drift.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-06-30T23:45:13.417Z
Answers: 2020-06-30T23:45:13.417Z
Answers: Woodland
Body: <p>I know that Terraform dose some checks before the plan and can detect some changes but not others such as detecting changes to variables on a lambda but not detecting a new secret in a secret manager.</p>
  <p>Are changes to the IAM policy something it detects?</p>
  
Tags: <amazon-web-services><terraform>
Title: Are manual changes to an aws IAM policy detected by Terraform plan?
UserDisplayName: doug
ThreadText: # Are manual changes to an aws IAM policy detected by Terraform plan?
  
  (Asked by: username_0 on 2020-06-30)
  
  I know that Terraform dose some checks before the plan and can detect some changes but not others such as detecting changes to variables on a lambda but not detecting a new secret in a secret manager.
  
  Are changes to the IAM policy something it detects?
  
  **Tags:** amazon-web-services, terraform
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-06-30. Score: 3 | Accepted answer
  
  Yes, Terraform will detect drift in IAM policies.
  
  Here is my starting point, a policy that allows full S3 and SQS access to specific resources.
  
  ```
  data "aws_iam_policy_document" "task" {
    statement {
      effect  = "Allow"
      actions = ["sqs:*"]
      resources = [
        aws_sqs_queue.my-queue.arn
      ]
    }
  
    statement {
      effect  = "Allow"
      actions = ["s3:*"]
      resources = [
        "${aws_s3_bucket.my_bucket.arn}",
        "${aws_s3_bucket.my_bucket.arn}/*",
      ]
    }
  }
  
  resource "aws_iam_policy" "task_role" {
    name   = "my-task-policy"
    policy = data.aws_iam_policy_document.task.json
  }
  
  ```
  
  I then manually added `ec2:DescribeInstances` to this policy via the AWS management console.
  
  To test whether it was detected or not, I ran `terraform apply -target aws_iam_policy.task_role`
  
  ```
  An execution plan has been generated and is shown below.
  Resource actions are indicated with the following symbols:
    ~ update in-place
  
  Terraform will perform the following actions:
  
    # aws_iam_policy.task_role will be updated in-place
    ~ resource "aws_iam_policy" "task_role" {
          arn    = "arn:aws:iam::111111111111:policy/my-task-policy"
          id     = "arn:aws:iam::111111111111:policy/my-task-policy"
          name   = "my-task-policy"
          path   = "/"
        ~ policy = jsonencode(
            ~ {
                ~ Statement = [
                    ... REDACTED...
                    - {
                        - Action   = "ec2:DescribeInstances"
                        - Effect   = "Allow"
                        - Resource = "*"
                        - Sid      = "VisualEditor0"
                      },
                  ]
                  Version   = "2012-10-17"
              }
          )
      }
  
  Plan: 0 to add, 1 to change, 0 to destroy.
  
  ```
  
  So Terraform correctly detected the drift.
  
  
  ---
  
  