Add support for managed policies in permission sets

modules/aws/permission_sets/README.md

@@ -14,6 +14,7 @@ module "permission_sets" {
   description         = <VALUE>
   identity_store_arn  = <VALUE>
   inline_policies     = ARRAY(<INLINE_POLICY>)
+  managed_policies    = ARRAY(<MANAGED_POLICY_NAME>)
 }
 ```
 
@@ -23,7 +24,8 @@ This module expects the variables to conform to the following:
 - `name` - Must be a string between 1 and 64 characters.
 - `description` - Must be a string between 1 and 256 characters.
 - `identity_store_arn` - Must be a valid Identity Store ARN.
-- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema.
+- `inline_policies` - Must be a list of objects that conforms to [Inline Policy](#inline-policy) schema. Can be empty.
+- `managed_policies` - Must be a list of strings that are valid managed policy names. Can be empty.
 
 ### Inline Policy
 

modules/aws/permission_sets/main.tf

@@ -30,3 +30,11 @@ resource "aws_ssoadmin_permission_set_inline_policy" "permission_set_inline_poli
   instance_arn       = var.identity_store_arn
   permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
 }
+
+resource "aws_ssoadmin_managed_policy_attachment" "permission_set_managed_policy" {
+  for_each = toset(var.managed_policies)
+
+  managed_policy_arn = "arn:aws:iam::aws:policy/${each.value}"
+  permission_set_arn = aws_ssoadmin_permission_set.identity_store_permission_set.arn
+  instance_arn       = var.identity_store_arn
+}

modules/aws/permission_sets/variables.tf

@@ -30,4 +30,11 @@ variable "inline_policies" {
     actions        = list(string)
     resources = list(string)
   }))
+  default = []
+}
+
+variable "managed_policies" {
+  description = "The inline policy to attach to the permission set."
+  type        = list(string)
+  default = []
 }