Refactor cloudwatch monitoring policy module (#21)

It was previously named _role, but it didn't create any actual IAM role.
To keep the consistency with other modules in this repo, I've changed the sufix of the module to `_policy`, and modified it so it outputs the policy instead of attaching it to anything.

README.md

@@ -205,26 +205,33 @@ Add a role that can be used by cloudcheckr to collect data and stats
   }
 ```
 
-## CloudWatch Monitoring role
+## cloudwatch_monitoring_policy
 
-Adding role for cloudwatch monitoring to allow instance to send custom metrics
+Creates an IAM policy that allows sending metrics to CloudWatch. You must attach that policy to a role, user or group.
 
-### Available variables
+### Inputs
 
-* [`instance_role`]: String(required): The name of the instance role to attach the policies to.
-* [`app`]: String(optional): The name of the application to be used in role name.
-* [`project`]: String(optional): The name of the project to be used in role name.
-* [`environment`]: String(optional): The name of the enviroment to be used in role name.
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:-----:|
+| name | Name to differentiate the policy name. Name will be autogenerated if omitted | `string` | `null` | no |
 
-### Example
+### Outputs
+
+| Name | Description |
+|------|-------------|
+| iam_policy_arn | ARN of the Cloudwatch monitoring IAM policy |
+| iam_policy_id | ID of the Cloudwatch monitoring IAM policy |
+| iam_policy_name | Name of the Cloudwatch monitoring IAM policy |### Example
 
 ```tf
-module "iam-monitoring" {
-  source        = "github.com/skyscrapers/terraform-iam//cloudwatch_monitoring_role"
-  environment   = "${terraform.workspace}"
-  project       = "${var.project}"
-  app           = "api"
-  instance_role = "${aws_iam_role.role.name}"
+module "iam_monitoring" {
+  source = "github.com/skyscrapers/terraform-iam//cloudwatch_monitoring_policy"
+  name   = "my_project"
+}
+
+resource "aws_iam_role_policy_attachment" "cloudwatch_policy" {
+  role       = aws_iam_role.my_role.name
+  policy_arn = module.iam_monitoring.iam_policy_arn
 }
 ```
 

cloudwatch_monitoring_policy/main.tf

@@ -0,0 +1,22 @@
+data "aws_iam_policy_document" "cloudwatch_monitoring_policy" {
+  statement {
+    sid = "CloudWatchMonitoring"
+
+    actions = [
+      "cloudwatch:PutMetricData",
+      "cloudwatch:GetMetricStatistics",
+      "cloudwatch:ListMetrics",
+      "ec2:DescribeTags"
+    ]
+
+    effect = "Allow"
+
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_policy" "cloudwatch_monitoring_policy" {
+  name        = var.name != null ? "cloudwatch_monitoring_${var.name}" : null
+  name_prefix = var.name == null ? "cloudwatch_monitoring_" : null
+  policy      = data.aws_iam_policy_document.cloudwatch_monitoring_policy.json
+}

cloudwatch_monitoring_policy/outputs.tf

@@ -0,0 +1,14 @@
+output "iam_policy_arn" {
+  description = "ARN of the Cloudwatch monitoring IAM policy"
+  value       = aws_iam_policy.cloudwatch_monitoring_policy.arn
+}
+
+output "iam_policy_name" {
+  description = "Name of the Cloudwatch monitoring IAM policy"
+  value       = aws_iam_policy.cloudwatch_monitoring_policy.name
+}
+
+output "iam_policy_id" {
+  description = "ID of the Cloudwatch monitoring IAM policy"
+  value       = aws_iam_policy.cloudwatch_monitoring_policy.id
+}

cloudwatch_monitoring_policy/variables.tf

@@ -0,0 +1,5 @@
+variable "name" {
+  description = "Name to differentiate the policy name. Name will be autogenerated if omitted"
+  type        = string
+  default     = null
+}