Terraform dynamic json content - json

Question

Environment : Terraform 0.12.X
If variable var.cloudfront_distributionId is not empty then this should add cloudfront policy
else should not
locals {
codebuild_policy = {
Version = "2012-10-17"
Statement = [
{
Effect = "Allow",
Resource = [
"*"
],
Action = [
"ec2:*"
]
},
{
#count = length(var.cloudfront_distributionId) != 0 ? 1 : 0
effect = "Allow",
Action = [
"cloudfront:ListInvalidations",
"cloudfront:GetInvalidation",
"cloudfront:CreateInvalidation"
],
Resource = [
for cf_id in var.cloudfront_distributionId:
"arn:aws:cloudfront::xxxxxxxx:distribution/${cf_id}"
]
}
]
}
}
resource "aws_iam_role_policy" "codebuild" {
count = local.env_build_resource.count
name = "${var.namespace}-${var.environment}-${var.service_name}"
role = element(aws_iam_role.codebuild.*.name, 0)
policy = jsonencode(local.codebuild_policy)
}
Example 1
cloudfront_distributionId = ["1", "2"]
then
Resource = ["1", "2"]. which is working
Example 2
cloudfront_distributionId = [] is empty
It is creating, werein it should not get created.
+ {
+ Action = [
+ "cloudfront:ListInvalidations",
+ "cloudfront:GetInvalidation",
+ "cloudfront:CreateInvalidation",
]
+ Resource = []
+ count = 0
+ effect = "Allow"
},
How can I achieve this ?

Answer 1

There are some parts missing in your code, thus its difficult to verify the answer form me, but I think the following could be attempted:
resource "aws_iam_role_policy" "codebuild" {
# remaining attributes
policy = length(var.cloudfront_distributionId) > 0 ? jsonencode(local.codebuild_policy): null
}

Answer 2

This is not really a JSON-specific question but rather a general question about conditionally including items in a list, because from Terraform's perspective that Statement attribute of your object is just a normal list value.
One way to think of this is as the concatenation of two lists, one of which might be empty. We can concatenate lists using the concat function, and then use normal conditional expressions to decide the length of the second list to concatenate:
locals {
codebuild_policy = {
Version = "2012-10-17"
Statement = concat(
[
{
Effect = "Allow",
Resource = [
"*"
],
Action = [
"ec2:*"
]
},
],
length(var.cloudfront_distributionId) != 0 ? [
{
Effect = "Allow",
Action = [
"cloudfront:ListInvalidations",
"cloudfront:GetInvalidation",
"cloudfront:CreateInvalidation"
],
Resource = [
for cf_id in var.cloudfront_distributionId :
"arn:aws:cloudfront::xxxxxxxx:distribution/${cf_id}"
]
}
] : [],
)
}
}