title: Terraform aws_iam_role_policy This policy defines some actions, resources, or conditions that do not provide permissions
body: <p>I created an &quot;aws_iam_role_policy&quot; resource for granting access to CloudWatch MSK metrics. I created an output to collect the ARN for the MSK cluster because I had to restrict the access to specific MSK cluster only. However I ran into permission error after I applied it when I was testing by aws kafka list-clusters --region $REGION. <br>
  <strong>An error occurred (AccessDeniedException) when calling the ListClusters operation: User: arn:aws:sts::xxxxxxxx:assumed-role/my-instance-role/xxxxxxxxxx is not authorized to perform: kafka:ListClusters on resource: arn:aws:kafka:us-west-2:xxxxxx:/v1/clusters</strong>
  <br> And I also see the warning <strong>This policy defines some actions, resources, or conditions that do not provide permissions. To grant access, policies must have an action that has an applicable resource or condition.</strong> for this msk_access policy on AWS Console. Did I miss any actions or sth. else?</p>
  <pre><code>resource &quot;aws_iam_role_policy&quot; &quot;msk_access&quot; {
    name = &quot;${element(split(&quot;-&quot;, var.product), 0)}-${var.env}-${var.region}-msk-access&quot;
    role = module.instance_role.instance_role
  
    policy = &lt;&lt;EOF
  {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Action&quot;: [
                  &quot;kafka:Describe*&quot;,
                  &quot;kafka:List*&quot;,
                  &quot;kafka:Get*&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Resource&quot;: &quot;${data.terraform_remote_state.msk_vpc[0].outputs.cluster_arn}&quot;
          }
      ]
  }
  EOF
  
  }
  </code></pre>