kumogata-template 0.0.35 → 0.0.36

data/lib/kumogata/template/const.rb

@@ -2,22 +2,26 @@
 # AWS Constants
 #
 
+DOMAIN = 'amazonaws.com'
+
 # http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-available-regions
 AWS_REGION = {
-  virginia:   "us-east-1",
-  ohio:       "us-east-2",
-  california: "us-west-1",
-  oregon:     "us-west-2",
-  canada:     "ca-central-1",
-  ireland:    "eu-west-1",
-  frankfurt:  "eu-central-1",
-  london:     "eu-west-2",
-  tokyo:      "ap-northeast-1",
-  seoul:      "ap-northeast-2",
-  singapore:  "ap-southeast-1",
-  sydney:     "ap-southeast-2",
-  mumbai:     "ap-south-1",
-  saopaulo:   "sa-east-1",
+  virginia:    "us-east-1",
+  ohio:        "us-east-2",
+  california:  "us-west-1",
+  oregon:      "us-west-2",
+  canada:      "ca-central-1",
+  frankfurt:   "eu-central-1",
+  ireland:     "eu-west-1",
+  london:      "eu-west-2",
+  paris:       "eu-west-3",
+  tokyo:       "ap-northeast-1",
+  seoul:       "ap-northeast-2",
+  osaka_local: "ap-northeast-3",
+  singapore:   "ap-southeast-1",
+  sydney:      "ap-southeast-2",
+  mumbai:      "ap-south-1",
+  saopaulo:    "sa-east-1",
 }
 
 PORT = {
@@ -27,8 +31,9 @@ PORT = {
   memcached: 11211,
   mysql: 3306,
   mariadb: 3306,
-  aurora: 3306,
+  "aurora-mysql": 3306,
   postgres: 5432,
+  "aurora-postgres": 5432,
   redis: 6379,
   redshift: 5439,
 }
@@ -47,7 +52,7 @@ DEFAULT_SNAPSHOT_TIME = {
 
 EC2_DEFAULT_IMAGE = "amazon linux official"
 
-# https://aws.amazon.com/ec2/pricing/
+# https://aws.amazon.com/ec2/instance-types/
 EC2_INSTANCE_TYPES =
   [
    # Model     vCPU  CPU(Credits/hour)  Mem(GiB)   Storage
@@ -75,6 +80,15 @@ EC2_INSTANCE_TYPES =
    # c4.8xlarge  36     60       EBS-Only  4,000
    "c4.large", "c4.xlarge", "c4.2xlarge", "c4.4xlarge", "c4.8xlarge",
 
+   # Model      vCPU   Mem(GiB)  Storage   EBS(Mbps)
+   # c5.large      2      4      EBS-Only  Up to 2,250
+   # c5.xlarge     4      8      EBS-Only  Up to 2,250
+   # c5.2xlarge    8     16      EBS-Only  Up to 2,250
+   # c5.4xlarge   16     32      EBS-Only  2,250
+   # c5.9xlarge   36     72      EBS-Only  4,500
+   # c5.18xlarge  72    144      EBS-Only  9,000
+   'c5.large', 'c5.xlarge', 'c5.2xlarge', 'c5.4xlarge', 'c5.9xlarge', 'c5.18xlarge',
+
    # Model      vCPU   Mem(GiB)  SSD Storage(GB)
    # r3.large     2     15.25      1 x 32
    # r3.xlarge    4     30.5       1 x 80
@@ -83,6 +97,15 @@ EC2_INSTANCE_TYPES =
    # r3.8xlarge  32    244         2 x 320
    "r3.large", "r3.xlarge", "r3.2xlarge", "r3.4xlarge", "r3.8xlarge",
 
+   # Model      vCPU   Mem (GiB)  Networking Perf.  SSD Storage (GB)
+   # r4.large      2    15.25     Up to 10 Gigabit   EBS-Only
+   # r4.xlarge     4    30.5      Up to 10 Gigabit   EBS-Only
+   # r4.2xlarge    8    61        Up to 10 Gigabit   EBS-Only
+   # r4.4xlarge   16   122        Up to 10 Gigabit   EBS-Only
+   # r4.8xlarge   32   244        10 Gigabit         EBS-Only
+   # r4.16xlarge  64   488        25 Gigabit         EBS-Only
+   'r4.large', 'r4.2xlarge', 'r4.4xlarge', 'r4.8xlarge', 'r4.16xlarge',
+
    # Model      vCPU   Mem(GiB) SSD Storage(GB)
    # i2.xlarge    4     30.5    1 x 800
    # i2.2xlarge   8     61      2 x 800
@@ -94,13 +117,24 @@ EC2_INSTANCE_TYPES =
    # x1.16xlarge   64     174.5    1 x 1,920 SSD    10
    # x1.32xlarge  128   1,952      2 x 1,902 SSD    10
    "x1.16xlarge", "x1.32xlarge",
+
+   # Model        vCPU   Mem(GiB)   Storage(GB)     Network(Gbps)
+   # x1e.32xlarge  128   3,904      2 x 1,920       14,000
+   # x1e.16xlarge   64   1,952      1 x 1,920       7,000
+   # x1e.8xlarge    32     976      1 x 960         3,500
+   # x1e.4xlarge    16     488      1 x 480         1,750
+   # x1e.2xlarge     8     244      1 x 240         1,000
+   # x1e.xlarge      4     122      1 x 120          500
+   'x1e.32xlarge', 'x1e.16xlarge', 'x1e.8xlarge', 'x1e.4xlarge', 'x1e.2xlarge', 'x1e.xlarge',
   ]
 EC2_DEFAULT_INSTANCE_TYPE = "t2.micro"
 
 ELASTICACHE_DEFAULT_ENGINE = "redis"
+# aws --region <REGION> elasticache describe-cache-engine-versions \
+#     | jq -r '.CacheEngineVersions[] | select(.Engine == "<ENGINE>") | .EngineVersion'
 ELASTICACHE_DEFAULT_ENGINE_VERSION = {
-  memcached: "1.4.24",
-  redis: "2.8.24",
+  memcached: "1.4.5",
+  redis: "2.8.6",
 }
 # https://aws.amazon.com/elasticache/pricing/
 ELASTICACHE_NODE_TYPES =
@@ -109,31 +143,34 @@ ELASTICACHE_NODE_TYPES =
    # cache.t2.micro      1     0.555      Low to Moderate
    # cache.t2.small      1     1.55       Low to Moderate
    # cache.t2.medium     2     3.22       Low to Moderate
+   "cache.t2.micro", "cache.t2.small", "cache.t2.medium",
+
+   # Cache Node Type   vCPU   Mem (GiB)   Network Performance
    # cache.m3.medium     1     2.78       Moderate
    # cache.m3.large      2     6.05       Moderate
    # cache.m3.xlarge     4    13.3        High
    # cache.m3.2xlarge    8    27.9        High
-   # cache.r3.large      2    13.5        Moderate
-   # cache.r3.xlarge     4    28.4        Moderate
-   # cache.r3.2xlarge    8    58.2        High
-   # cache.r3.4xlarge   16   118          High
-   # cache.r3.8xlarge   32   237          10 Gigabit
+   "cache.m3.medium", "cache.m3.large", "cache.m3.xlarge", "cache.m3.2xlarge",
+
    # cache.m4.large      2     6.42       Moderate
    # cache.m4.xlarge     4    14.28       High
    # cache.m4.2xlarge    8    29.70       High
    # cache.m4.4xlarge   16    60.78       High
    # cache.m4.10xlarge  40   154.64       10 Gigabit
-   "cache.t2.micro", "cache.t2.small", "cache.t2.medium",
-   "cache.m3.medium", "cache.m3.large", "cache.m3.xlarge",
-   "cache.m3.2xlarge", "cache.r3.large", "cache.r3.xlarge",
+   "cache.m4.large", "cache.m4.xlarge",
+   "cache.m4.2xlarge", "cache.m4.4xlarge", "cache.m4.10xlarge",
+
+   # cache.r3.large      2    13.5        Moderate
+   # cache.r3.xlarge     4    28.4        Moderate
+   # cache.r3.2xlarge    8    58.2        High
+   # cache.r3.4xlarge   16   118          High
+   # cache.r3.8xlarge   32   237          10 Gigabit
+   "cache.r3.large", "cache.r3.xlarge",
    "cache.r3.2xlarge", "cache.r3.4xlarge", "cache.r3.8xlarge",
-   "cache.m4.large", "cache.m4.xlarge", "cache.m4.2xlarge",
-   "cache.m4.4xlarge", "cache.m4.10xlarge",
   ]
 ELASTICACHE_DEFAULT_NODE_TYPE = "cache.t2.medium"
 
 # https://aws.amazon.com/rds/pricing/
-# http://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html
 RDS_INSTANCE_CLASSES =
   [
    # Instance Class   vCPU   ECU   Memory (GB)   EBS Optimized   Network Performance
@@ -142,41 +179,60 @@ RDS_INSTANCE_CLASSES =
    # db.m4.2xlarge     8     25.5   32            1000 Mbps        High
    # db.m4.4xlarge    16     53.5   64            2000 Mbps        High
    # db.m4.10xlarge   40    124.5  160           4000 Mbps        10 GBps
+   "db.m4.large", "db.m4.xlarge", "db.m4.2xlarge", "db.m4.4xlarge", "db.m4.10xlarge",
+
+   # Instance Class   vCPU   ECU   Memory (GB)   EBS Optimized   Network Performance
    # db.r3.large       2      6.5   15             No              Moderate
    # db.r3.xlarge      4     13     30.5           500 Mbps        Moderate
    # db.r3.2xlarge     8     26     61            1000 Mbps        High
    # db.r3.4xlarge    16     52    122            2000 Mbps        High
    # db.r3.8xlarge    32    104    244             No              10 Gbps
+   "db.r3.large", "db.r3.xlarge", "db.r3.2xlarge", "db.r3.4xlarge", "db.r3.8xlarge",
+
+   # Instance Class   vCPU   ECU   Memory (GB)   EBS Optimized   Network Performance
    # db.t2.micro       1      1      1             No              Low
    # db.t2.small       1      1      2             No              Low
    # db.t2.medium      2      2      4             No              Moderate
    # db.t2.large       2      2      8             No              Moderate
-   "db.m4.large", "db.m4.xlarge", "db.m4.2xlarge", "db.m4.4xlarge", "db.m4.10xlarge",
-   "db.r3.large", "db.r3.xlarge", "db.r3.2xlarge", "db.r3.4xlarge", "db.r3.8xlarge",
    "db.t2.micro", "db.t2.small", "db.t2.medium", "db.t2.large",
   ]
 RDS_DEFAULT_INSTANCE_CLASS = "db.t2.medium"
+
+RDS_AURORA_INSTANCE_CLASSES =
+  [
+   "db.t2.small", "db.t2.medium", "db.t2.large",
+   "db.r3.large", "db.r3.xlarge", "db.r3.2xlarge", "db.r3.4xlarge", "db.r3.8xlarge",
+  ]
+RDS_AURORA_DEFAULT_INSTANCE_CLASS = "db.t2.medium"
+
 RDS_DEFAULT_ENGINE = "mysql"
+RDS_DEFAULT_CLUSTER_ENGINE = 'aurora-mysql'
+# aws --region <REGION> rds describe-db-engine-versions --query "DBEngineVersions[] | [?Engine == 'mysql'].EngineVersion"
 RDS_DEFAULT_ENGINE_VERSION = {
-  mysql: "5.7.17",
-  mariadb: "10.1.23",
   aurora: "5.6.10a",
-  postgres: "9.6.2",
+  "aurora-mysql": "5.7.12",
+  "aurora-postgresql": "9.6.3",
+  mariadb: "10.1.26",
+  mysql: "5.7.19",
+  postgres: "9.6.6",
 }
 
 # https://aws.amazon.com/redshift/pricing/
 REDSHIFT_NODE_TYPES =
   [
-   # Node Size   vCPU   ECU    RAM (GiB)   Slices Per Node   Storage Per Node   Node Range   Total Capacity
-   # ds1.xlarge    2      4.4     15               2                2 TB HDD       1–32          64 TB
-   # ds1.8xlarge  16     35      120              16               16 TB HDD       2–128          2 PB
-   # ds2.xlarge    4     13       31               2                2 TB HDD       1–32          64 TB
-   # ds2.8xlarge  36    119      244              16               16 TB HDD       2–128          2 PB
-   # dc1.large     2      7       15               2              160 GB SSD       1–32           5.12 TB
-   # dc1.8xlarge  32    104      244              32             2.56 TB SSD       2–128        326 TB
-   "ds1.xlarge", "ds1.8xlarge", "ds2.xlarge", "ds2.8xlarge", "dc1.large", "dc1.8xlarge",
+   # Dense Compute
+   # Node Size   vCPU   ECU   RAM(GiB)   Slices Per Node  Storage Per Node   Node Range   Total Capacity
+   # dc2.large     2     7     15.25            2          160 GB NVMe-SSD      1–32         5.12 TB
+   # dc2.8xlarge  32    99    244              16          2.56 TB NVMe-SSD     2–128         326 TB
+   "dc2.large", "dc2.8xlarge",
+
+   # Dense Storage
+   # Node Size   vCPU   ECU   RAM(GiB)   Slices Per Node  Storage Per Node   Node Range   Total Capacity
+   # ds2.xlarge    4     13    31               2            2 TB HDD           1–32        64 TB
+   # ds2.8xlarge  36    119   244              16           16 TB HDD           2–128        2 PB
+   "ds2.xlarge", "ds2.8xlarge",
   ]
-REDSHIFT_DEFAULT_NODE_TYPE = "ds1.xlarge"
+REDSHIFT_DEFAULT_NODE_TYPE = "dc2.large"
 
 # https://aws.amazon.com/elasticmapreduce/pricing/
 EMR_INSTANCE_TYPES =
@@ -192,14 +248,20 @@ EMR_DEFAULT_RELEASE = "emr-4.6.0"
 
 ELB_ACCESS_LOG_ACCOUNT_ID = {
   "us-east-1": "127311923021",
-  "us-west-2": "797873946194",
+  "us-east-2": "033677994240",
   "us-west-1": "027434742980",
-  "eu-west-1": "156460612806",
+  "us-west-2": "797873946194",
+  "ca-central-1": "985666609251",
   "eu-central-1": "054676820928",
-  "ap-southeast-1": "114774131450",
+  "eu-west-1": "156460612806",
+  "eu-west-2": "652711504416",
+  "eu-west-3": "009996457667",
   "ap-northeast-1": "582318560864",
-  "ap-southeast-2": "783225319266",
   "ap-northeast-2": "600734575887",
+  "ap-northeast-3": "383597477331",
+  "ap-southeast-1": "114774131450",
+  "ap-southeast-2": "783225319266",
+  "ap-south-1":	"718504428378",
   "sa-east-1": "507241528517",
 }
 

data/lib/kumogata/template/datapipeline.rb

@@ -4,87 +4,56 @@
 require 'kumogata/template/helper'
 
 def _datapipeline_parameter_objects(args)
-  objects = args[:parameter_objects] || []
-
-  array = []
-  objects.each do |object|
-    object.each do |id, value|
+  (args[:parameter_objects] || []).collect do |object|
+    object.collect do |id, value|
       attributes = _datapipeline_parameter_objects_attributes(value)
-      array << _{
+
+      _{
         Attributes attributes
         Id id
       }
     end
-  end
-  array
+  end.flatten
 end
 
 def _datapipeline_parameter_objects_attributes(args)
-  attributes = args[:attributes] || {}
-
-  array = []
-  attributes.each do |key, value|
-    array << _{
+  (args[:attributes] || {}).collect do |key, value|
+    _{
       Key key
       StringValue value
     }
   end
-  array
 end
 
 def _datapipeline_parameter_values(args)
-  values = args[:parameter_values] || {}
-
-  array = []
-  values.each do |id, val|
-    array << _{
+  (args[:parameter_values] || {}).collect do |id, value|
+    _{
       Id id
-      StringValue val
+      StringValue value
     }
   end
-  array
 end
 
 def _datapipeline_pipeline_objects(args)
-  objects = args[:objects] || []
-
-  array = []
-  objects.each do |object|
-    object.each do |id, value|
+  (args[:objects] || []).collect do |object|
+    object.collect do |id, value|
       fields = _datapipeline_pipeline_object_fields(value)
-      array << _{
+      _{
         Fields fields
         Id id
         Name value[:name]
       }
     end
-  end
-  array
+  end.flatten
 end
 
 def _datapipeline_pipeline_object_fields(args)
-  fields = args[:fields] || {}
-
-  array = []
-  fields.each do |key, value|
-    array << _{
+  (args[:fields] || {}).collect do |key, value|
+    _{
       Key key
       RefValue value[:ref] if value.key? :ref
       StringValue value[:string] if value.key? :string
     }
   end
-  array
 end
 
-def _datapipeline_pipeline_tags(args)
-  tags = args[:tags] || {}
-
-  array = []
-  tags.each do |key, value|
-    array << _{
-      Key key
-      Value value
-    }
-  end
-  array
-end

data/lib/kumogata/template/dynamodb.rb

@@ -13,8 +13,7 @@ def _dynamodb_attribute(args)
     end
   end
 
-  array = []
-  attributes.each do |attribute|
+  attributes.collect do |attribute|
     type =
       case attribute[:type].to_sym
       when :binary
@@ -24,12 +23,11 @@ def _dynamodb_attribute(args)
       else
         "S"
       end
-    array << _{
+    _{
       AttributeName attribute[:value]
       AttributeType type
     }
   end
-  array
 end
 
 def _dynamodb_key_schema(args)
@@ -42,8 +40,7 @@ def _dynamodb_key_schema(args)
     end
   end
 
-  array = []
-  schemas.each do |schema|
+  schemas.collect do |schema|
     type =
       case schema[:type].to_sym
       when :range
@@ -51,12 +48,11 @@ def _dynamodb_key_schema(args)
       else
         "hash"
       end
-    array << _{
+    _{
       AttributeName schema[:value]
       KeyType type.upcase
     }
   end
-  array
 end
 
 def _dynamodb_projection(args)
@@ -109,3 +105,16 @@ def _dynamodb_local(args)
     Projection projection
   }
 end
+
+def _dynamodb_ttl(args)
+  ttl = args[:ttl] || {}
+  return ttl if ttl.empty?
+
+  attr = args[:attr] || ""
+  enabled = _bool("enabled", args, true)
+
+  _{
+    AttributeName attr unless attr.empty?
+    Enabled enabled
+  }
+end

data/lib/kumogata/template/ec2.rb

@@ -3,6 +3,27 @@
 #
 require 'kumogata/template/helper'
 
+def _ec2_to_block_device_ecs(args)
+  root_device = {
+    device: "/dev/xvda",
+    delete: _bool("root_delete", args, true),
+    size: args[:root_size] || 8,
+    type: "gp2",
+  }
+  root_device[:ref_size] = "#{args[:ref_root_size]} root" if _ref_key? "root_size", args, '', false
+
+  # /dev/xvdcz is Docker's use storage
+  data_device = {
+     device: "/dev/xvdcz",
+     delete: _bool("data_delete", args, true),
+     size: args[:data_size],
+     type: "gp2",
+  }
+  data_device[:ref_size] = "#{args[:ref_data_size]} data" if _ref_key? "data_size", args, '', false
+
+  [ root_device, data_device ]
+end
+
 def _ec2_tags(args)
   if args.key? :tags_append
     tags_append = {}
@@ -33,6 +54,7 @@ def _ec2_security_group_egress_rule(args)
   cidr = args[:cidr] || "0.0.0.0/0"
   cidr_ipv6 = args[:cidr_ipv6] || ""
   dest_security = _ref_string("dest_security", args, "security group")
+  description = _ref_string_default("description", args, '', "egress rule description")
   from = _ref_string("from", args)
   ip = args[:ip] || "tcp"
   dest_prefix = _ref_string("dest_prefix", args, "vpc endpoint")
@@ -43,6 +65,7 @@ def _ec2_security_group_egress_rule(args)
     CidrIp cidr if dest_security.empty?
     CidrIpv6 cidr_ipv6 unless cidr_ipv6.empty?
     DestinationPrefixListId dest_prefix unless dest_prefix.empty?
+    Description description
     FromPort from unless ip == "icmp"
     IpProtocol ip
     DestinationSecurityGroupId dest_security unless dest_security.empty?
@@ -69,18 +92,20 @@ end
 def _ec2_security_group_ingress_rule(args)
   cidr = args[:cidr] || "0.0.0.0/0"
   cidr_ipv6 = args[:cidr_ipv6] || ""
+  description = _ref_string_default("description", args, '', "inbound rule description")
   from = _ref_string("from", args)
   ip = args[:ip] || "tcp"
   source_group_name = _ref_string("source_group_name", args, "security group")
   source_group_id = _ref_string("source_group_id", args, "security group")
   source_group_owner_id = _ref_string("source_group_owner_id", args, "account id")
   to = _ref_string("to", args)
-  to = from if to.empty?
+  to = from.clone if to.empty?
   ip = -1 and from = 0 and to = 65535 if ip == "all"
 
   _{
     CidrIp cidr if source_group_name.empty? and source_group_id.empty?
     CidrIpv6 cidr_ipv6 unless cidr_ipv6.empty?
+    Description description
     FromPort from unless ip == "icmp"
     IpProtocol ip
     SourceSecurityGroupName source_group_name unless source_group_name.empty?
@@ -91,7 +116,7 @@ def _ec2_security_group_ingress_rule(args)
 end
 
 def _ec2_block_device(args)
-  device = args[:device] || "/dev/sda1"
+  device = args[:device] || "/dev/sdb"
   delete = _bool("delete", args, true)
   encrypted = _bool("encrypted", args, false)
   iops = args[:iops] || 300
@@ -147,12 +172,17 @@ def _ec2_network_interface_embedded(args, is_spot = false)
   }
 end
 
-def _ec2_image(instance_type, args)
-  image_id = args[:image_id] || false
-  return args[:image_id] if image_id
+def _ec2_image(args)
+  return args[:image_id] if args.key? :image_id
 
-  resource_image = _resource_name(args[:image] || EC2_DEFAULT_IMAGE)
-  _find_in_map("AWSRegionArch2AMI#{resource_image}",
+  image =
+    if args.key? :ecs
+      "ecs official"
+    else
+      args[:image] || EC2_DEFAULT_IMAGE
+    end
+  instance_type = _ref_string("instance_type", args, "instance type")
+  _find_in_map("AWSRegionArch2AMI#{_resource_name(image)}",
                _region,
                _find_in_map("AWSInstanceType2Arch", instance_type, "Arch"))
 end
@@ -179,12 +209,33 @@ def _ec2_protocol_number(protocol)
 end
 
 def _ec2_user_data(args)
-  user_data = _ref_string("user_data", args, "user data")
-  return "" if user_data.empty?
+  if args.key? :user_data
+    user_data = args[:user_data]
+  else
+    user_data = _ref_string("user_data", args, "user data")
+  end
+
+  return '' if user_data.empty?
 
   if user_data.is_a? Hash
     _base64(user_data)
   else
+    if user_data.is_a? String
+      if user_data.nil? or user_data.empty?
+        user_data = []
+      else
+        user_data = [ user_data ]
+      end
+    end
+    if args.key? :ecs
+      # http://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-agent-config.html
+      ecs_user_data =<<"EOS"
+cat <<'EOF' >> /etc/ecs/ecs.config
+ECS_CLUSTER=#{_name("ecs", args)}
+EOF
+EOS
+      user_data = user_data.insert(0, ecs_user_data)
+    end
     _base64_shell(user_data)
   end
 end
@@ -229,7 +280,7 @@ def _ec2_spot_fleet_launches(args)
   iam = _ref_string("iam", args, "iam instance profile")
   iam = _ref_attr_string("iam", "Arn", args, "iam instance profile") if iam.empty?
   instance_type = _ref_string("instance_type", args, "instance type")
-  image =_ec2_image(instance_type, args)
+  image = _ec2_image(args)
   kernel = args[:kernel] || ""
   key_name = _ref_string("key_name", args, "key name")
   monitoring = _bool("monitoring", args, false)

data/lib/kumogata/template/ecr.rb

@@ -5,15 +5,17 @@ require 'kumogata/template/helper'
 require 'kumogata/template/iam'
 
 def _ecr_policy(name, args)
-  action = args[name.to_sym][:action] || []
-  user = args[name.to_sym][:user] || []
-  account = args[name.to_sym][:account]
-  principal = { account: account }
-  policy = {
-    service: "ecr",
-    action: action,
-    principal: principal,
+  policy = args[name.to_sym] || {}
+  return policy if policy.empty?
+
+  iam_policy = {
+    service: 'ecr',
     no_resource: true,
   }
-  _iam_policy_document("policy", { policy: [ policy ] })
+  iam_policy[:sid] = policy[:sid] if policy.key? :sid
+  iam_policy[:principal] = policy[:principal] if policy.key? :principal
+  iam_policy[:actions] = policy[:actions] if policy.key? :actions
+  iam_policy[:action] = policy[:action] if policy.key? :action
+
+  _iam_policy_document('policy', { policy: [ iam_policy ] })
 end