Allows to parse s3 bucket policies from a terraform state and convert them to aws_iam_policy_document data source

convert_bucket_policies_from_tf_state_to_data_source.py

from json import load, loads
from jinja2 import Template

template = """data "aws_iam_policy_document" "{{ bucket }}" {
  {%- for st in statement %}
  statement {
    sid    = "{{ st.Sid }}"
    effect = "{{ st.Effect }}"

    actions = [
    {%- if st.Action is string %}
      "{{ st.Action }}",
    {%- else %}
    {%- for action in st.Action %}
      "{{action}}", 
    {%- endfor %}
    {%- endif %}
    ]
    
    resources = [
    {%- if st.Resource is string %}
      "{{ st.Resource }}",
    {%- else %}
    {%- for resource in st.Resource %}
      "{{ resource }}",
    {%- endfor %}
    {%- endif %}
    ]

    principals {
      type = "AWS"
      
      identifiers = [
      {%- if st.Principal.AWS is string %}
        "{{ st.Principal.AWS }}",
      {%- else %}
      {%- for principal in st.Principal.AWS %}
        "{{ principal }}",
      {%- endfor %}
      {%- endif %}
      ]
    }
  }
  {% endfor %}
}

resource "aws_s3_bucket_policy" "{{ bucket }}" {
  bucket = "{{ bucket }}"
  policy = "${data.aws_iam_policy_document.{{ bucket }}.json}"
}
"""

with open('./terraform.tfstate', 'r') as state:
    data = load(state)
    resources = data.get('modules')[0].get('resources')
    for k, v in resources.items():
        if 'policy' in k:
            bucket = v['primary']['attributes']['bucket']
            policy = loads(v['primary']['attributes']['policy'])

            rendered = Template(template).render(bucket=v['primary']['attributes']['bucket'],
                                                 statement=policy['Statement'])
            with open(f'./policies/{bucket}.tf', 'w') as policy_file:
                policy_file.write(rendered)

policy_example.tf

data "aws_iam_policy_document" "policy" {
  statement {
    sid    = "CurrentAccountS3FullAccess"
    effect = "Allow"

    actions = [
      "s3:*",
    ]
    
    resources = [
      "<bucket_arn>/*",
      "<bucket_arn>",
    ]

    principals {
      type = "AWS"
      
      identifiers = [
        "<aws_account_id>",
      ]
    }
  }
  
  statement {
    sid    = "OtherAccountS3ReadAccess"
    effect = "Allow"

    actions = [
      "s3:List*",
      "s3:Get*",
    ]
    
    resources = [
      "<bucket_arn>/*",
      "<bucket_arn",
    ]

    principals {
      type = "AWS"
      
      identifiers = [
        "<aws_account_id>",
      ]
    }
  }
}