title: terraform: is there a way to create iam policy statements dynamically?
body: <p>Terraform version: 0.11</p>
  
  <p>I am running multiple eks clusters and trying to enable IAM Roles-based service account in all cluster following this doc:
  <a href="https://www.terraform.io/docs/providers/aws/r/eks_cluster.html#enabling-iam-roles-for-service-accounts" rel="noreferrer">https://www.terraform.io/docs/providers/aws/r/eks_cluster.html#enabling-iam-roles-for-service-accounts</a></p>
  
  <p>This works when I hardcode the cluster name in the policy statement and create multiple statements </p>
  
  <pre><code>data "aws_iam_policy_document" "example_assume_role_policy" {
  
  # for cluster 1
  
    statement {
      actions = ["sts:AssumeRoleWithWebIdentity"]
      effect  = "Allow"
  
      condition {
        test     = "StringEquals"
        variable = "${replace(aws_iam_openid_connect_provider.example1.url, "https://", "")}:sub"
        values   = ["system:serviceaccount:kube-system:aws-node"]
      }
  
      principals {
        identifiers = ["${aws_iam_openid_connect_provider.example1.arn}"]
        type        = "Federated"
      }
    }
  }
  </code></pre>
  
  <p>Since I have multiple clusters, I want to be able to generate the statement dynamically
  so I made the following changes: </p>
  
  <p>I created a <code>count</code> variable and changed values in principals and and condition</p>
  
  <pre><code>count = "${length(var.my_eks_cluster)}" 
  
      condition {
        test     = "StringEquals"
        variable = "${replace(element(aws_iam_openid_connect_provider.*.url, count.index), "https://", "")}:sub"
        values   = ["system:serviceaccount:kube-system:aws-node"]
      }
  
      principals {
        identifiers = ["${element(aws_iam_openid_connect_provider.*.url, count.index)}"]
        type        = "Federated"
      }
  </code></pre>
  
  <p>Terraform now is able to find the clusters BUT also generate multiple policies. 
  And this will not work, since in the following syntax, the assume_role_policy doesn't take the list</p>
  
  <pre><code>resource "aws_iam_role" "example" {
    assume_role_policy = "${data.aws_iam_policy_document.example_assume_role_policy.*.json}"
    name               = "example"
  }
  </code></pre>
  
  <p>It seems like instead of creating multiple policies, I need to generate multiple statements in one policy (so I can add to one iam_role).  Has anyone done something similar before ? Thanks.</p>