assume_role_policy not idempotent (or just bad policydoc?) #19349
Labels
bug
Addresses a defect in current functionality.
service/iam
Issues and PRs that pertain to the iam service.
stale
Old or inactive issues managed by automation, if no further action taken these will get closed.
Community Note
Description
Hello Terraform friends.
I'm running the below code, and every time it runs it looks like something has changed, where it's just moving things around.
I've run with TF_LOG=TRACE and extracted the urlencoded value we are sending to AWS and it looks fine to me. If I paste
that into the AWS web console it works fine. If I run with
aws iam update-assume-role-policy --role-name tmp-1 --policy-doc this_doc.json
it works fine.
I do see this warning in the trace logs (linked below)
The values are generated via terragrunt and we've tried jsonencoding the assume_role_policy as well, but that results in an error. The 2nd and 3rd policy were split out as a troubleshooting step, they used to be just 1; but this results in the same issue. Looks like a change being applied every time we run. Have also sorted the values generated for the accounts but this has no effect.
This could be bad policydoc, but I've applied via cli and webconsole and it goes in just fine.
Please halp. ;)
Terraform CLI and Terraform AWS Provider Version
Affected Resource(s)
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
Debug Output
https://gist.github.com/shawn-sterling/a08655c9dc03e77b1806544fbf6c862f#file-tf-trace-log
Expected Behavior
terraform should create the role + assume role in a idempotent way so future runs do not look like they have changes.
Actual Behavior
Every time we run terraform it applies a "new" change (it moves around a few values).
Steps to Reproduce
terraform apply -var-file test.json
terraform apply -var-file test.json
Important Factoids
N/A
References
N/A
The text was updated successfully, but these errors were encountered: