title: What's the most efficient way to determine the minimum AWS permissions necessary for a Terraform configuration?
body: <p>I have a Terraform configuration targeting deployment on AWS. It applies beautifully when using an IAM user that has permission to do anything (i.e. <code>{actions: ["*"], resources: ["*"]}</code>. </p>
  
  <p>In pursuit of automating the application of this Terraform configuration, I want to determine the <em>minimum</em> set of permissions necessary to apply the configuration initially and effect subsequent changes. I specifically want to avoid giving overbroad permissions in policy, e.g. <code>{actions: ["s3:*"], resources: ["*"]}</code>.</p>
  
  <p>So far, I'm simply running <code>terraform apply</code> until an error occurs. I look at the output or at the terraform log output to see what API call failed and then add it to the deployment user policy. EC2 and S3 are particularly frustrating because the name of the actions seems to not necessarily align with the API method name. I'm several hours into this with easy way to tell how far long I am.</p>
  
  <p><strong>Is there a more efficient way to do this?</strong> </p>
  
  <p>It'd be really nice if Terraform advised me what permission/action I need but that's a product enhancement best left to Hashicorp.</p>