From d149602720f1920358dfcfca16c4c09726755541 Mon Sep 17 00:00:00 2001
From: Brian Flad <bflad417@gmail.com>
Date: Fri, 14 Sep 2018 12:49:04 -0400
Subject: [PATCH] resource/aws_iam_policy: Ensure description is properly read
 during creation

This resource was previously not following best practices of calling the read function after creation. Now it will read back information from the API, which tangentally fixes the description not being available in the CreatePolicy response.

Changes:
* Create separate acceptance tests for all arguments
* Call read function after create and update functions
* Create `testAccCheckResourceAttrGlobalARN` for checking global ARN attributes
* Remove extraneous aws/import_aws_iam_policy_test.go

Previously (before code updates):

```
=== RUN   TestAccAWSIAMPolicy_basic
--- PASS: TestAccAWSIAMPolicy_basic (10.15s)
=== RUN   TestAccAWSIAMPolicy_description
--- FAIL: TestAccAWSIAMPolicy_description (5.06s)
    testing.go:527: Step 0 error: Check failed: Check 2/2 error: aws_iam_policy.test: Attribute 'description' expected "description1", got ""
=== RUN   TestAccAWSIAMPolicy_namePrefix
--- PASS: TestAccAWSIAMPolicy_namePrefix (9.72s)
=== RUN   TestAccAWSIAMPolicy_path
--- PASS: TestAccAWSIAMPolicy_path (9.85s)
=== RUN   TestAccAWSIAMPolicy_policy
--- PASS: TestAccAWSIAMPolicy_policy (13.49s)
```

Now:

```
=== RUN   TestAccAWSIAMPolicy_basic
--- PASS: TestAccAWSIAMPolicy_basic (10.29s)
=== RUN   TestAccAWSIAMPolicy_description
--- PASS: TestAccAWSIAMPolicy_description (8.00s)
=== RUN   TestAccAWSIAMPolicy_namePrefix
--- PASS: TestAccAWSIAMPolicy_namePrefix (9.15s)
=== RUN   TestAccAWSIAMPolicy_path
--- PASS: TestAccAWSIAMPolicy_path (9.25s)
=== RUN   TestAccAWSIAMPolicy_policy
--- PASS: TestAccAWSIAMPolicy_policy (15.21s)
```
---
 aws/import_aws_iam_policy_test.go   |  88 ----------
 aws/provider_test.go                |  13 ++
 aws/resource_aws_iam_policy.go      | 123 +++++++++-----
 aws/resource_aws_iam_policy_test.go | 254 +++++++++++++++++++++-------
 4 files changed, 286 insertions(+), 192 deletions(-)
 delete mode 100644 aws/import_aws_iam_policy_test.go

diff --git a/aws/import_aws_iam_policy_test.go b/aws/import_aws_iam_policy_test.go
deleted file mode 100644
index 2dbd553bda7..00000000000
--- a/aws/import_aws_iam_policy_test.go
+++ /dev/null
@@ -1,88 +0,0 @@
-package aws
-
-import (
-	"fmt"
-	"testing"
-
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
-	"github.com/aws/aws-sdk-go/service/iam"
-
-	"github.com/hashicorp/terraform/helper/resource"
-	"github.com/hashicorp/terraform/terraform"
-)
-
-func testAccAwsIamPolicyConfig(suffix string) string {
-	return fmt.Sprintf(`
-resource "aws_iam_policy" "test_%[1]s" {
-    name = "test_policy_%[1]s"
-    path = "/"
-    description = "My test policy"
-    policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-`, suffix)
-}
-
-func TestAccAWSIAMPolicy_importBasic(t *testing.T) {
-	suffix := randomString(10)
-	resourceName := fmt.Sprintf("aws_iam_policy.test_%s", suffix)
-
-	resource.Test(t, resource.TestCase{
-		PreCheck:     func() { testAccPreCheck(t) },
-		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckAWSPolicyDestroy,
-		Steps: []resource.TestStep{
-			{
-				Config: testAccAwsIamPolicyConfig(suffix),
-			},
-
-			{
-				ResourceName:      resourceName,
-				ImportState:       true,
-				ImportStateVerify: true,
-			},
-		},
-	})
-}
-
-func testAccCheckAWSPolicyDestroy(s *terraform.State) error {
-	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
-
-	for _, rs := range s.RootModule().Resources {
-		if rs.Type != "aws_iam_policy" {
-			continue
-		}
-
-		// Try to get group
-		_, err := iamconn.GetPolicy(&iam.GetPolicyInput{
-			PolicyArn: aws.String(rs.Primary.ID),
-		})
-		if err == nil {
-			return fmt.Errorf("still exist.")
-		}
-
-		// Verify the error is what we want
-		ec2err, ok := err.(awserr.Error)
-		if !ok {
-			return err
-		}
-		if ec2err.Code() != "NoSuchEntity" {
-			return err
-		}
-	}
-
-	return nil
-}
diff --git a/aws/provider_test.go b/aws/provider_test.go
index f9d383f049d..b7f427897a0 100644
--- a/aws/provider_test.go
+++ b/aws/provider_test.go
@@ -112,6 +112,19 @@ func testAccCheckResourceAttrRegionalARN(resourceName, attributeName, arnService
 	}
 }
 
+// testAccCheckResourceAttrGlobalARN ensures the Terraform state exactly matches a formatted ARN without region
+func testAccCheckResourceAttrGlobalARN(resourceName, attributeName, arnService, arnResource string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		attributeValue := arn.ARN{
+			AccountID: testAccGetAccountID(),
+			Partition: testAccGetPartition(),
+			Resource:  arnResource,
+			Service:   arnService,
+		}.String()
+		return resource.TestCheckResourceAttr(resourceName, attributeName, attributeValue)(s)
+	}
+}
+
 // testAccGetAccountID returns the account ID of testAccProvider
 // Must be used returned within a resource.TestCheckFunc
 func testAccGetAccountID() string {
diff --git a/aws/resource_aws_iam_policy.go b/aws/resource_aws_iam_policy.go
index 33adf4f5c2e..a5c8449ba3a 100644
--- a/aws/resource_aws_iam_policy.go
+++ b/aws/resource_aws_iam_policy.go
@@ -2,13 +2,13 @@ package aws
 
 import (
 	"fmt"
+	"log"
 	"net/url"
 	"regexp"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
-
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
@@ -112,7 +112,9 @@ func resourceAwsIamPolicyCreate(d *schema.ResourceData, meta interface{}) error
 		return fmt.Errorf("Error creating IAM policy %s: %s", name, err)
 	}
 
-	return readIamPolicy(d, response.Policy)
+	d.SetId(*response.Policy.Arn)
+
+	return resourceAwsIamPolicyRead(d, meta)
 }
 
 func resourceAwsIamPolicyRead(d *schema.ResourceData, meta interface{}) error {
@@ -121,39 +123,93 @@ func resourceAwsIamPolicyRead(d *schema.ResourceData, meta interface{}) error {
 	getPolicyRequest := &iam.GetPolicyInput{
 		PolicyArn: aws.String(d.Id()),
 	}
+	log.Printf("[DEBUG] Getting IAM Policy: %s", getPolicyRequest)
 
-	getPolicyResponse, err := iamconn.GetPolicy(getPolicyRequest)
-	if err != nil {
-		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
-			d.SetId("")
-			return nil
+	// Handle IAM eventual consistency
+	var getPolicyResponse *iam.GetPolicyOutput
+	err := resource.Retry(1*time.Minute, func() *resource.RetryError {
+		var err error
+		getPolicyResponse, err = iamconn.GetPolicy(getPolicyRequest)
+
+		if d.IsNewResource() && isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+			return resource.RetryableError(err)
 		}
+
+		if err != nil {
+			return resource.NonRetryableError(err)
+		}
+
+		return nil
+	})
+
+	if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+		log.Printf("[WARN] IAM Policy (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	if err != nil {
 		return fmt.Errorf("Error reading IAM policy %s: %s", d.Id(), err)
 	}
 
+	if getPolicyResponse == nil || getPolicyResponse.Policy == nil {
+		log.Printf("[WARN] IAM Policy (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
+	}
+
+	d.Set("arn", getPolicyResponse.Policy.Arn)
+	d.Set("description", getPolicyResponse.Policy.Description)
+	d.Set("name", getPolicyResponse.Policy.PolicyName)
+	d.Set("path", getPolicyResponse.Policy.Path)
+
+	// Retrieve policy
+
 	getPolicyVersionRequest := &iam.GetPolicyVersionInput{
 		PolicyArn: aws.String(d.Id()),
 		VersionId: getPolicyResponse.Policy.DefaultVersionId,
 	}
+	log.Printf("[DEBUG] Getting IAM Policy Version: %s", getPolicyVersionRequest)
 
-	getPolicyVersionResponse, err := iamconn.GetPolicyVersion(getPolicyVersionRequest)
-	if err != nil {
-		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
-			d.SetId("")
-			return nil
+	// Handle IAM eventual consistency
+	var getPolicyVersionResponse *iam.GetPolicyVersionOutput
+	err = resource.Retry(1*time.Minute, func() *resource.RetryError {
+		var err error
+		getPolicyVersionResponse, err = iamconn.GetPolicyVersion(getPolicyVersionRequest)
+
+		if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+			return resource.RetryableError(err)
 		}
-		return fmt.Errorf("Error reading IAM policy version %s: %s", d.Id(), err)
+
+		if err != nil {
+			return resource.NonRetryableError(err)
+		}
+
+		return nil
+	})
+
+	if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+		log.Printf("[WARN] IAM Policy (%s) not found, removing from state", d.Id())
+		d.SetId("")
+		return nil
 	}
 
-	policy, err := url.QueryUnescape(*getPolicyVersionResponse.PolicyVersion.Document)
 	if err != nil {
-		return err
+		return fmt.Errorf("Error reading IAM policy version %s: %s", d.Id(), err)
 	}
-	if err := d.Set("policy", policy); err != nil {
-		return err
+
+	policy := ""
+	if getPolicyVersionResponse != nil && getPolicyVersionResponse.PolicyVersion != nil {
+		var err error
+		policy, err = url.QueryUnescape(aws.StringValue(getPolicyVersionResponse.PolicyVersion.Document))
+		if err != nil {
+			return fmt.Errorf("error parsing policy: %s", err)
+		}
 	}
 
-	return readIamPolicy(d, getPolicyResponse.Policy)
+	d.Set("policy", policy)
+
+	return nil
 }
 
 func resourceAwsIamPolicyUpdate(d *schema.ResourceData, meta interface{}) error {
@@ -163,9 +219,6 @@ func resourceAwsIamPolicyUpdate(d *schema.ResourceData, meta interface{}) error
 		return err
 	}
 
-	if !d.HasChange("policy") {
-		return nil
-	}
 	request := &iam.CreatePolicyVersionInput{
 		PolicyArn:      aws.String(d.Id()),
 		PolicyDocument: aws.String(d.Get("policy").(string)),
@@ -175,7 +228,8 @@ func resourceAwsIamPolicyUpdate(d *schema.ResourceData, meta interface{}) error
 	if _, err := iamconn.CreatePolicyVersion(request); err != nil {
 		return fmt.Errorf("Error updating IAM policy %s: %s", d.Id(), err)
 	}
-	return nil
+
+	return resourceAwsIamPolicyRead(d, meta)
 }
 
 func resourceAwsIamPolicyDelete(d *schema.ResourceData, meta interface{}) error {
@@ -190,12 +244,14 @@ func resourceAwsIamPolicyDelete(d *schema.ResourceData, meta interface{}) error
 	}
 
 	_, err := iamconn.DeletePolicy(request)
+	if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+		return nil
+	}
+
 	if err != nil {
-		if iamerr, ok := err.(awserr.Error); ok && iamerr.Code() == "NoSuchEntity" {
-			return nil
-		}
 		return fmt.Errorf("Error deleting IAM policy %s: %#v", d.Id(), err)
 	}
+
 	return nil
 }
 
@@ -275,18 +331,3 @@ func iamPolicyListVersions(arn string, iamconn *iam.IAM) ([]*iam.PolicyVersion,
 	}
 	return response.Versions, nil
 }
-
-func readIamPolicy(d *schema.ResourceData, policy *iam.Policy) error {
-	d.SetId(*policy.Arn)
-	d.Set("description", policy.Description)
-	if err := d.Set("path", policy.Path); err != nil {
-		return err
-	}
-	if err := d.Set("name", policy.PolicyName); err != nil {
-		return err
-	}
-	if err := d.Set("arn", policy.Arn); err != nil {
-		return err
-	}
-	return nil
-}
diff --git a/aws/resource_aws_iam_policy_test.go b/aws/resource_aws_iam_policy_test.go
index e26a4b57db9..88da6113d29 100644
--- a/aws/resource_aws_iam_policy_test.go
+++ b/aws/resource_aws_iam_policy_test.go
@@ -3,51 +3,164 @@ package aws
 import (
 	"fmt"
 	"regexp"
-	"strings"
 	"testing"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/service/iam"
+	"github.com/hashicorp/terraform/helper/acctest"
 	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/terraform"
 )
 
-func TestAWSPolicy_namePrefix(t *testing.T) {
+func TestAccAWSIAMPolicy_basic(t *testing.T) {
 	var out iam.GetPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_iam_policy.test"
 
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckAWSPolicyDestroy,
+		CheckDestroy: testAccCheckAWSIAMPolicyDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccAWSPolicyPrefixNameConfig,
+				Config: testAccAWSIAMPolicyConfigName(rName),
 				Check: resource.ComposeTestCheckFunc(
-					testAccCheckAWSPolicyExists("aws_iam_policy.policy", &out),
-					testAccCheckAWSPolicyGeneratedNamePrefix(
-						"aws_iam_policy.policy", "test-policy-"),
-					resource.TestCheckResourceAttr("aws_iam_policy.policy", "description", ""),
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					testAccCheckResourceAttrGlobalARN(resourceName, "arn", "iam", fmt.Sprintf("policy/%s", rName)),
+					resource.TestCheckResourceAttr(resourceName, "description", ""),
+					resource.TestCheckResourceAttr(resourceName, "name", rName),
+					resource.TestCheckResourceAttr(resourceName, "path", "/"),
+					resource.TestCheckResourceAttr(resourceName, "policy", `{"Version":"2012-10-17","Statement":[{"Action":["ec2:Describe*"],"Effect":"Allow","Resource":"*"}]}`),
 				),
 			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func TestAWSPolicy_invalidJson(t *testing.T) {
+func TestAccAWSIAMPolicy_description(t *testing.T) {
+	var out iam.GetPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_iam_policy.test"
+
 	resource.Test(t, resource.TestCase{
 		PreCheck:     func() { testAccPreCheck(t) },
 		Providers:    testAccProviders,
-		CheckDestroy: testAccCheckAWSPolicyDestroy,
+		CheckDestroy: testAccCheckAWSIAMPolicyDestroy,
 		Steps: []resource.TestStep{
 			{
-				Config:      testAccAWSPolicyInvalidJsonConfig,
+				Config: testAccAWSIAMPolicyConfigDescription(rName, "description1"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					resource.TestCheckResourceAttr(resourceName, "description", "description1"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccAWSIAMPolicy_namePrefix(t *testing.T) {
+	var out iam.GetPolicyOutput
+	namePrefix := "tf-acc-test-"
+	resourceName := "aws_iam_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIAMPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSIAMPolicyConfigNamePrefix(namePrefix),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					resource.TestMatchResourceAttr(resourceName, "name", regexp.MustCompile(fmt.Sprintf("^%s", namePrefix))),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"name_prefix"},
+			},
+		},
+	})
+}
+
+func TestAccAWSIAMPolicy_path(t *testing.T) {
+	var out iam.GetPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_iam_policy.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIAMPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSIAMPolicyConfigPath(rName, "/path1/"),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					resource.TestCheckResourceAttr(resourceName, "path", "/path1/"),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
+		},
+	})
+}
+
+func TestAccAWSIAMPolicy_policy(t *testing.T) {
+	var out iam.GetPolicyOutput
+	rName := acctest.RandomWithPrefix("tf-acc-test")
+	resourceName := "aws_iam_policy.test"
+	policy1 := "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+	policy2 := "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSIAMPolicyDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSIAMPolicyConfigPolicy(rName, "not-json"),
 				ExpectError: regexp.MustCompile("invalid JSON"),
 			},
+			{
+				Config: testAccAWSIAMPolicyConfigPolicy(rName, policy1),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					resource.TestCheckResourceAttr(resourceName, "policy", policy1),
+				),
+			},
+			{
+				Config: testAccAWSIAMPolicyConfigPolicy(rName, policy2),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSIAMPolicyExists(resourceName, &out),
+					resource.TestCheckResourceAttr(resourceName, "policy", policy2),
+				),
+			},
+			{
+				ResourceName:      resourceName,
+				ImportState:       true,
+				ImportStateVerify: true,
+			},
 		},
 	})
 }
 
-func testAccCheckAWSPolicyExists(resource string, res *iam.GetPolicyOutput) resource.TestCheckFunc {
+func testAccCheckAWSIAMPolicyExists(resource string, res *iam.GetPolicyOutput) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[resource]
 		if !ok {
@@ -73,60 +186,75 @@ func testAccCheckAWSPolicyExists(resource string, res *iam.GetPolicyOutput) reso
 	}
 }
 
-func testAccCheckAWSPolicyGeneratedNamePrefix(resource, prefix string) resource.TestCheckFunc {
-	return func(s *terraform.State) error {
-		r, ok := s.RootModule().Resources[resource]
-		if !ok {
-			return fmt.Errorf("Resource not found")
+func testAccCheckAWSIAMPolicyDestroy(s *terraform.State) error {
+	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
+
+	for _, rs := range s.RootModule().Resources {
+		if rs.Type != "aws_iam_policy" {
+			continue
 		}
-		name, ok := r.Primary.Attributes["name"]
-		if !ok {
-			return fmt.Errorf("Name attr not found: %#v", r.Primary.Attributes)
+
+		_, err := iamconn.GetPolicy(&iam.GetPolicyInput{
+			PolicyArn: aws.String(rs.Primary.ID),
+		})
+
+		if isAWSErr(err, iam.ErrCodeNoSuchEntityException, "") {
+			continue
 		}
-		if !strings.HasPrefix(name, prefix) {
-			return fmt.Errorf("Name: %q, does not have prefix: %q", name, prefix)
+
+		if err != nil {
+			return err
 		}
-		return nil
+
+		return fmt.Errorf("IAM Policy (%s) still exists", rs.Primary.ID)
 	}
+
+	return nil
+}
+
+func testAccAWSIAMPolicyConfigDescription(rName, description string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  description = %q
+  name        = %q
+  policy      = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+}
+`, description, rName)
 }
 
-const testAccAWSPolicyPrefixNameConfig = `
-resource "aws_iam_policy" "policy" {
-	name_prefix = "test-policy-"
-	path = "/"
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-  "Statement": [
-    {
-      "Action": [
-        "ec2:Describe*"
-      ],
-      "Effect": "Allow",
-      "Resource": "*"
-    }
-  ]
-}
-EOF
-}
-`
-const testAccAWSPolicyInvalidJsonConfig = `
-resource "aws_iam_policy" "policy" {
-	name_prefix = "test-policy-"
-	path = "/"
-  policy = <<EOF
-  {
-    "Version": "2012-10-17",
-    "Statement": [
-      {
-        "Action": [
-          "ec2:Describe*"
-        ],
-        "Effect": "Allow",
-        "Resource": "*"
-      }
-    ]
-  }
-  EOF
-}
-`
+func testAccAWSIAMPolicyConfigName(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  name   = %q
+  policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+}
+`, rName)
+}
+
+func testAccAWSIAMPolicyConfigNamePrefix(namePrefix string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  name_prefix = %q
+  policy      = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+}
+`, namePrefix)
+}
+
+func testAccAWSIAMPolicyConfigPath(rName, path string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  name   = %q
+  path   = %q
+  policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":[\"ec2:Describe*\"],\"Effect\":\"Allow\",\"Resource\":\"*\"}]}"
+}
+`, rName, path)
+}
+
+func testAccAWSIAMPolicyConfigPolicy(rName, policy string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_policy" "test" {
+  name   = %q
+  policy = %q
+}
+`, rName, policy)
+}