add managed policy exclusivity, replace deprecated manged_policy_arn value

.gitignore

@@ -10,4 +10,6 @@ env/
 .vscode
 *.code-workspace
 *.sha256
+terraform.tfstate
+terraform.tfstate.backup
 

main.tf

@@ -298,13 +298,16 @@ resource "aws_iam_role" "this" {
     }
   )
 
-  managed_policy_arns = concat(["arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"], var.instance_profile_policies)
-
   tags = merge(local.tags, {
     Name = "${var.iam_resource_names_prefix}-role-${var.name}"
   })
 }
-
+# Attach instance profile policies
+resource "aws_iam_role_policy_attachment" "this" {
+  for_each   = { for k, v in var.instance_profile_policies : k => v }
+  role       = aws_iam_role.this.name
+  policy_arn = each.value
+}
 data "aws_iam_policy_document" "ssm_params_and_secrets" {
   count = var.ssm_parameters != null || var.secretsmanager_secrets != null ? 1 : 0
   dynamic "statement" {

test/unit-test/locals.tf

@@ -8,10 +8,11 @@ data "http" "environments_file" {
 }
 locals {
 
-  # create list of common managed policies that can be attached to ec2 instance profiles
-  ec2_common_managed_policies = [
-    aws_iam_policy.ec2_test_common_policy.arn
-  ]
+  # create map of common managed policies that can be attached to ec2 instance profiles
+  ec2_common_managed_policies = {
+    AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+    ec2-test-common-policy       = aws_iam_policy.ec2_test_common_policy.arn
+  }
 
   tags = {
     component = "test"

variables.tf

@@ -149,7 +149,10 @@ variable "iam_resource_names_prefix" {
 }
 
 variable "instance_profile_policies" {
-  type        = list(string)
+  type = map(string)
+  default = {
+    AmazonSSMManagedInstanceCore = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+  }
   description = "A list of managed IAM policy document ARNs to be attached to the instance profile"
 }