fix: Use new dedicated aws_iam_role_policy resource.

Author: jamesiarmes

malware.tf

@@ -9,18 +9,21 @@ resource "aws_iam_role" "malware" {
     partition : data.aws_partition.current.partition
     region : data.aws_region.current.region
   })))
+}
 
-  inline_policy {
-    name = "${local.bucket_name}-malware"
-    policy = jsonencode(yamldecode(templatefile("${path.module}/templates/malware-policy.yaml.tftpl", {
-      account : data.aws_caller_identity.identity.account_id
-      bucket_arn : module.this.arn
-      kms_key_arn : local.kms_key_arn
-      partition : data.aws_partition.current.partition
-      region : data.aws_region.current.region
-    })))
-  }
+resource "aws_iam_role_policy" "malware" {
+  for_each = var.enable_malware_protection ? toset(["this"]) : toset([])
+
+  name = "${local.bucket_name}-malware"
+  role = aws_iam_role.malware["this"].name
 
+  policy = jsonencode(yamldecode(templatefile("${path.module}/templates/malware-policy.yaml.tftpl", {
+    account : data.aws_caller_identity.identity.account_id
+    bucket_arn : module.this.arn
+    kms_key_arn : local.kms_key_arn
+    partition : data.aws_partition.current.partition
+    region : data.aws_region.current.region
+  })))
 }
 
 resource "aws_guardduty_malware_protection_plan" "this" {