Destroying aws_iam_user_login_profile does not remove the user's password

[tomtomau]

Hi there,

Not sure if I've misinterpreted something in the docs or stumbled upon a bit of a security hole.

Terraform Version

Terraform v0.11.4

• provider.aws v1.11.0

Affected Resource(s)

• aws_iam_user_login_profile

Terraform Configuration Files

resource "aws_iam_user" "foo" {
  name                    = "${var.foo_username}"
  force_destroy           = true
}

resource "aws_iam_user_login_profile" "foo" {
  user                    = "${aws_iam_user.foo.name}"
  pgp_key                 = "${var.pgp_key}"
  password_reset_required = false
}

output "password" {
  value = "${aws_iam_user_login_profile.foo.encrypted_password}"
}

Expected Behavior

User should not be able to login with the login profile we just deleted.

Actual Behavior

The user can login with the login profile that was supposedly deleted.

Steps to Reproduce

1. terraform apply
2. Take password, decrypt and check that you can login through the console
3. terraform destroy --target=aws_iam_user_login_profile.foo
4. Try logging in once more with the same credentials and you will be able to login

Important Factoids

If you follow the below steps, you won't get a password output, which I believe is probably because it's executing this code branch

1. terraform apply to apply all resources
2. terraform destroy --target=aws_iam_user_login_profile.foo
3. terraform apply to recreate the login profile
4. Assert that the output says the password is an empty string (but it should be an actual value)

References

• I think this is probably what's causing people (like me!) to get this: encrypted_secret output not showing in outputs #780

[moritzheiber]

Generally, the resource should support all available API actions properly. Right now it only supports create, and not even delete.

[bflad]

Hi folks 👋 Sorry for this long running issue. 😖 I think we will plan on addressing this along with #7536 as the resource desperately needs a major overhaul and its easiest just to bundle the work together. I'm marking as version 2.0.0 to ensure its captured during that maintainer work cycle with the other issue, but we are also willing to look at contributions ahead of time as this is indeed buggy behavior.

[bflad]

In version 2.0.0 of the Terraform AWS Provider, releasing later this week, the aws_iam_user_login_profile resource will now appropriately delete the login profile in IAM on Terraform resource destroy. 👍

[jkkathi1-zz]

Destroying aws_access_key_id resource would not destory the access_keys it created , resulting in duplicates . When you re-create the the same user the old keys used to appear on the AWS console .
Upgrading to version 2.0.0 of the AWS provider solved this issue .

[jkkathi1-zz]

Is there a Github group for AWS providers for terraform where the latest developments can be tracked and notifications can be setup

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!