Using terraform I am creating a simple bucket and applying a simple bucket policy that allows a role and a user to get access to it. The role/user is different for each account that is being deployed.

# Creating buckets
resource "aws_s3_bucket" "buckets" {
  for_each = var.s3_bucket_names

  bucket = "${var.prefix}-${var.environment}-${lower(var.github_branch)}-${each.key}"
}

# Apply Bucket policy to buckets.
resource "aws_s3_bucket_policy" "allow_access_to_bucket" {
  for_each = aws_s3_bucket.buckets

  bucket = each.value.id
  policy = templatefile("s3_policy.json", {
    tmp_s3_arn  = "${each.value.arn}",
    object_access = "${var.s3_object_access}"
  })
}

Then the policy is like:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3ObjectPermissions",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::${tmp_account}:role/role_case_one",
                    "arn:aws:sts::${tmp_account}:assumed-role/dev_role/[email protected]"]
            },
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:DeleteObject"
            ],
            "Resource": "${tmp_s3_arn}/*"
        }
    ]
}

But I want to parametrize the principal as they may change on different accounts. I have tried to replace the list of principals for a list in terraform, but it is trying to “add” a new terraform with the information of the list.

I tried to pass just a string and the same, it tries to add the string ad additional principal.

~ Principal = {
 ~ AWS = [
   - "arn:aws:iam::12345:role/role_case_one",
   - "arn:aws:sts::12345:assumed-role/assumed-role/dev_role/[email protected]",
 ] -> "[arn:aws:iam::12345:role/role_case_one,arn:aws:iam::12345:assumed-role/assumed-role/dev_role/[email protected]]"

How can I achieve this?