Use aws_iam_group_policy or aws_iam_role_policy resources to declare the policy inline, or attach the policy to aws_iam_group or aws_iam_role resources.

• Ensure that IAM policy definitions are not declared inline with the aws_iam_user_policy and aws_iam_user resources or attached to aws_iam_user resources with aws_iam_policy. Instead, IAM policy definitions should be declared inline with aws_iam_group_policy and aws_iam_role_policy resources, or attached to aws_iam_group and aws_iam_role resources with aws_iam_policy.
• Ensure that IAM policy definitions are not declared using aws_iam_policy_attachment, as it creates exclusive attachments of IAM policies across the entire AWS account. Instead, consider aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, or aws_iam_group_policy_attachment.

Example Configuration

resource "aws_iam_group_policy" "example" {
  name  = "my_group_policy"
  group = aws_iam_group.my_group.name
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "s3:ListAllMyBuckets",
        ]
        Effect = "Deny"
      },
    ]
  })
  # other required fields here
}

resource "aws_iam_group" "my_group" {
  name = "my_group"
  path = "/users/"
}