feat: add delete protection (#5)

Author: pevisscher

iam.tf

@@ -1,4 +1,5 @@
 data "aws_iam_policy_document" "read" {
+  count = var.output_policies ? 1 : 0
   statement {
     effect = "Allow"
     resources = [
@@ -15,6 +16,7 @@ data "aws_iam_policy_document" "read" {
 }
 
 data "aws_iam_policy_document" "scan" {
+  count = var.output_policies ? 1 : 0
   statement {
     effect = "Allow"
     resources = [
@@ -28,6 +30,7 @@ data "aws_iam_policy_document" "scan" {
 }
 
 data "aws_iam_policy_document" "write" {
+  count = var.output_policies ? 1 : 0
   statement {
     effect    = "Allow"
     resources = [aws_dynamodb_table.this.arn]
@@ -40,6 +43,7 @@ data "aws_iam_policy_document" "write" {
 }
 
 data "aws_iam_policy_document" "delete" {
+  count = var.output_policies ? 1 : 0
   statement {
     effect    = "Allow"
     resources = [aws_dynamodb_table.this.arn]

dynamodb.tf renamed to main.tf

@@ -19,6 +19,8 @@ resource "aws_dynamodb_table" "this" {
   hash_key  = var.hash_key.name
   range_key = try(var.range_key.name, null)
 
+  deletion_protection_enabled = var.deletion_protection_enabled
+
   dynamic "ttl" {
     for_each = var.ttl_attribute != null ? [var.ttl_attribute] : []
     content {
@@ -88,10 +90,6 @@ resource "aws_dynamodb_table" "this" {
   stream_view_type = var.stream_settings.enabled && var.stream_settings.kinesis == null ? var.stream_settings.view_type : null
 
   tags = var.tags
-
-  lifecycle {
-    prevent_destroy = true
-  }
 }
 
 resource "aws_dynamodb_kinesis_streaming_destination" "this" {

outputs.tf

@@ -3,10 +3,10 @@ output "table" {
 }
 
 output "policies" {
-  value = {
-    read   = data.aws_iam_policy_document.read,
-    scan   = data.aws_iam_policy_document.scan,
-    write  = data.aws_iam_policy_document.write,
-    delete = data.aws_iam_policy_document.delete,
-  }
+  value = var.output_policies ? {
+    read   = data.aws_iam_policy_document.read[0],
+    scan   = data.aws_iam_policy_document.scan[0],
+    write  = data.aws_iam_policy_document.write[0],
+    delete = data.aws_iam_policy_document.delete[0],
+  } : null
 }

variables.tf

@@ -2,13 +2,15 @@ variable "name" {
   description = "Name of the DynamoDB Table"
   type        = string
 }
+
 variable "hash_key" {
   description = "Hash key configuration."
   type = object({
     name = string
     type = optional(string, "S")
   })
 }
+
 variable "range_key" {
   description = "Range key configuration"
   type = object({
@@ -68,6 +70,12 @@ variable "local_secondary_indexes" {
   default = {}
 }
 
+variable "deletion_protection_enabled" {
+  description = "Enable deletion protection"
+  type        = bool
+  default     = true
+}
+
 variable "point_in_time_recovery_enabled" {
   description = "Enable point-in-time recovery (recommended)"
   type        = bool
@@ -110,4 +118,10 @@ variable "tags" {
   description = "Resource tags for the table"
   type        = map(string)
   default     = null
-}
+}
+
+variable "output_policies" {
+  description = "Generate default set of policies for the table"
+  type        = bool
+  default     = false
+}