IAM Policy

AWSリソースに対する権限を設定

3つの方法で設定できる

AWS 管理ポリシーをコピー

Policy Generator

独自のポリシーを作成

code:tf

resource "aws_iam_policy" "cloudwatch_read_only" {

name = "cloudwatch-read-only"

policy = data.aws_iam_policy_document.cloudwatch_read_only.json

}

data "aws_iam_policy_document" "cloudwatch_read_only" {

statement {

effect = "Allow"

actions = [

"cloudwatch:Describe*",

"cloudwatch:Get*",

"cloudwatch:List*"

]

}

}