Terrafrom aws_iam_policy_document condition correct syntax

Question

How can this S3 bucket IAM policy, which has multiple conditions, be re-written as aws_iam_policy_document data block, please?

    "Condition": {
      "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceAccount": "xxxxxxxxxxxx"
      },
      "ArnLike": {
          "aws:SourceArn": "arn:aws:s3:::my-tf-test-bucket"
      }
    }

With the aws_iam_policy_document condition data block syntax 1:

    condition {
      test = "StringEquals"
      values = []
      variable = ""
    }

Answer 1

The aws_iam_policy_document supports nested condition directives. The following Terraform configuration should help:

data "aws_iam_policy_document" "iam_policy_document" {
  condition {
    test = "StringEquals"

    values = [
      "bucket-owner-full-control"
    ]

    variable = "s3:x-amz-acl"
  }

  condition {
    test = "StringEquals"

    values = [
      "xxxxxxxxxxxx"
    ]

    variable = "aws:SourceAccount"
  }

  condition {
    test = "ArnLike"

    values = [
      "arn:aws:s3:::my-tf-test-bucket"
    ]

    variable = "aws:SourceArn"
  }
}