iam_implicit_policy.tf

# Create IAM policy to give implicit role permission to assume broad IAM Role
resource "aws_iam_policy" "ado_iam_role_permit_sts_assume" {
  name = "AzureDevOpsPolicyPermitStsAssume"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "${aws_iam_role.ado_iam_assumed_role.arn}"
    }
  ]
}
EOF

  lifecycle {
    prevent_destroy = true
  }
}