Answers: <p>The note callout at the top of <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" rel="nofollow noreferrer">the <code>aws_iam_policy_document</code> documentation</a> explains this syntax:</p>
  <blockquote>
  <p><strong>Note:</strong> AWS's IAM policy document syntax allows for replacement of <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html" rel="nofollow noreferrer">policy variables</a> within a statement using <code>${...}</code>-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use <code>&amp;{...}</code> notation for interpolations that should be processed by AWS rather than by Terraform.</p>
  </blockquote>
  <p>In other words, this is a special syntax implemented as a special case inside the <code>hashicorp/aws</code> Terraform provider to make it easier to use the IAM policy interpolation syntax without conflicting with Terraform's own template interpolation syntax. The provider will automatically replace <code>&amp;{</code> with <code>${</code> while it is rendering the final policy document.</p>
  
Answers: CC BY-SA 4.0
Answers: 2023-06-17T01:00:08.130Z
Answers: 2023-06-17T01:00:08.130Z
Answers: Martin Atkins
Body: <p>I coudn't find meaning of <code>&amp;</code> sign in Terraform or/and AWS IAM policy. There is an example in <code>Data Source: aws_iam_policy_document</code> (<a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document" rel="nofollow noreferrer">docs</a>) where you can see <code>Basic Example</code> (<a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#basic-example" rel="nofollow noreferrer">docs</a>, <a href="https://github.com/hashicorp/terraform-provider-aws/blob/5575f0cb17a8aa4c71b8359ccd80c7222b1de70c/website/docs/d/iam_policy_document.html.markdown?plain=1#L65-L66" rel="nofollow noreferrer">github source</a>):</p>
  <pre><code>data &quot;aws_iam_policy_document&quot; &quot;example&quot; {
    (..)
  
    statement {
      actions = [
        &quot;s3:*&quot;,
      ]
  
      resources = [
        &quot;arn:aws:s3:::${var.s3_bucket_name}/home/&amp;{aws:username}&quot;,
        &quot;arn:aws:s3:::${var.s3_bucket_name}/home/&amp;{aws:username}/*&quot;,
      ]
    }
  }
  </code></pre>
  <p>I cound't find the meaning of <code>&amp;{aws:username}</code>. I'd try to look up in AWS IAM documentation but there is only explanation how to use variables with dollar (<code>$</code>):</p>
  <blockquote>
  <p><em>The variable is marked using a $ prefix followed by a pair of curly braces ({ }).</em></p>
  </blockquote>
  <p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-using-variables" rel="nofollow noreferrer">Source</a></p>
  <p>Question: What does <code>&amp;</code> character mean in above example?</p>
  
Tags: <amazon-web-services><terraform>
Title: & (ampersand) in Terraform string or/and AWS IAM policy
UserDisplayName: sobi3ch
ThreadText: # & (ampersand) in Terraform string or/and AWS IAM policy
  
  (Asked by: username_0 on 2023-06-14)
  
  I coudn't find meaning of `&` sign in Terraform or/and AWS IAM policy. There is an example in `Data Source: aws_iam_policy_document` ([docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document)) where you can see `Basic Example` ([docs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#basic-example), [github source](https://github.com/hashicorp/terraform-provider-aws/blob/5575f0cb17a8aa4c71b8359ccd80c7222b1de70c/website/docs/d/iam_policy_document.html.markdown?plain=1#L65-L66)):
  
  ```
  data "aws_iam_policy_document" "example" {
    (..)
  
    statement {
      actions = [
        "s3:*",
      ]
  
      resources = [
        "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
        "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
      ]
    }
  }
  
  ```
  
  I cound't find the meaning of `&{aws:username}`. I'd try to look up in AWS IAM documentation but there is only explanation how to use variables with dollar (`$`):
  
  > *The variable is marked using a $ prefix followed by a pair of curly braces ({ }).*
  
  [Source](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#policy-vars-using-variables)
  
  Question: What does `&` character mean in above example?
  
  **Tags:** amazon-web-services, terraform
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2023-06-17. Score: 2
  
  The note callout at the top of [the `aws_iam_policy_document` documentation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) explains this syntax:
  
  > **Note:** AWS's IAM policy document syntax allows for replacement of [policy variables](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html) within a statement using `${...}`-style notation, which conflicts with Terraform's interpolation syntax. In order to use AWS policy variables with this data source, use `&{...}` notation for interpolations that should be processed by AWS rather than by Terraform.
  
  In other words, this is a special syntax implemented as a special case inside the `hashicorp/aws` Terraform provider to make it easier to use the IAM policy interpolation syntax without conflicting with Terraform's own template interpolation syntax. The provider will automatically replace `&{` with `${` while it is rendering the final policy document.
  
  
  ---
  
  