aws_iam _role upgrade to framework and inline policy change #35634

teddylear · 2024-02-05T00:51:24Z

Description

Upgrades aws_iam_role to terraform-plugin-framework and resolve issue with inline_policy being a set in sdkv2 to a map in the terraform-plugin-framework to resolve linked issue below with inline policy plans and fully deleting then recrating policies on changes instead of just updating in place and then removing policies that are no longer present. Using terraform from that issue with base terraform update here in new version of provider:

resource "aws_iam_role" "main" {
  assume_role_policy = data.aws_iam_policy_document.trust.json
  name               = "terraform-issue-reproduction"

  inline_policies = {
    "InlinePolicy" = data.aws_iam_policy_document.inline.json
  }
}

# Inline policy document that we'll be changing
data "aws_iam_policy_document" "inline" {
  statement {
    sid     = "S3"
    actions = ["s3:ListBucket"]
    resources = [
      "arn:aws:s3:::some-bucket-a",
      # After the first apply, uncomment this next line
      # "arn:aws:s3:::some-bucket-b",
    ]
  }
}

# Minimal, arbitrary trust statement to make the role valid
data "aws_iam_policy_document" "trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = ["apigateway.amazonaws.com"]
    }
  }
}

And the plan to add second bucket in inline policy produces this plan which is close to original one in ticket:

  # aws_iam_role.main will be updated in-place
  ~ resource "aws_iam_role" "main" {
        id                    = "terraform-issue-reproduction"
      ~ inline_policies       = {
          ~ "InlinePolicy" = jsonencode(
              ~ {
                  ~ Statement = [
                      ~ {
                          ~ Resource = "arn:aws:s3:::some-bucket-a" -> [
                              + "arn:aws:s3:::some-bucket-b",
                              + "arn:aws:s3:::some-bucket-a",
                            ]
                            # (3 unchanged attributes hidden)
                        },
                    ]
                    # (1 unchanged attribute hidden)
                }
            )
        }
        name                  = "terraform-issue-reproduction"
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Adding a third bucket produces this plan which is even more user friendly:

  # aws_iam_role.main will be updated in-place
  ~ resource "aws_iam_role" "main" {
        id                    = "terraform-issue-reproduction"
      ~ inline_policies       = {
          ~ "InlinePolicy" = jsonencode(
              ~ {
                  ~ Statement = [
                      ~ {
                          ~ Resource = [
                              + "arn:aws:s3:::some-bucket-c",
                                "arn:aws:s3:::some-bucket-b",
                                # (1 unchanged element hidden)
                            ]
                            # (3 unchanged attributes hidden)
                        },
                    ]
                    # (1 unchanged attribute hidden)
                }
            )
        }
        name                  = "terraform-issue-reproduction"
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

Please let me know if there's any other test or anything else I should be adding here. I tried to document as many behavior changes as possible in the existing tests. There are some import changes which are best noted in the tests and code itself. Also please let me know if I should squash commits.

Relations

Closes #22336

Output from Acceptance Testing

Added some new tests to confirm some validation functionality as well as upgrade from previous version of prodiver. Some existing tests had to be changed as result of migration to terraform-plugin-framework. I tried to document them as best as possible in role_test.go file.

 > make testacc TESTS=TestAccIAMRole_ PKG=iam

==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./internal/service/iam/... -v -count 1 -parallel 20 -run='TestAccIAMRole_'  -timeout 360m
=== RUN   TestAccIAMRole_basic
=== PAUSE TestAccIAMRole_basic
=== RUN   TestAccIAMRole_MigrateFromPluginSDK_basic
=== PAUSE TestAccIAMRole_MigrateFromPluginSDK_basic
=== RUN   TestAccIAMRole_description
=== PAUSE TestAccIAMRole_description
=== RUN   TestAccIAMRole_nameGenerated
=== PAUSE TestAccIAMRole_nameGenerated
=== RUN   TestAccIAMRole_namePrefix
=== PAUSE TestAccIAMRole_namePrefix
=== RUN   TestAccIAMRole_testNameChange
=== PAUSE TestAccIAMRole_testNameChange
=== RUN   TestAccIAMRole_diffsNoCondition
=== PAUSE TestAccIAMRole_diffsNoCondition
=== RUN   TestAccIAMRole_diffsCondition
=== PAUSE TestAccIAMRole_diffsCondition
=== RUN   TestAccIAMRole_badJSON
=== PAUSE TestAccIAMRole_badJSON
=== RUN   TestAccIAMRole_disappears
=== PAUSE TestAccIAMRole_disappears
=== RUN   TestAccIAMRole_policiesForceDetach
=== PAUSE TestAccIAMRole_policiesForceDetach
=== RUN   TestAccIAMRole_maxSessionDuration
=== PAUSE TestAccIAMRole_maxSessionDuration
=== RUN   TestAccIAMRole_permissionsBoundary
=== PAUSE TestAccIAMRole_permissionsBoundary
=== RUN   TestAccIAMRole_tags
=== PAUSE TestAccIAMRole_tags
=== RUN   TestAccIAMRole_InlinePolicy_basic
=== PAUSE TestAccIAMRole_InlinePolicy_basic
=== RUN   TestAccIAMRole_MigrateFromPluginSDK_InlinePolicy
=== PAUSE TestAccIAMRole_MigrateFromPluginSDK_InlinePolicy
=== RUN   TestAccIAMRole_InlinePolicy_badJSON
=== PAUSE TestAccIAMRole_InlinePolicy_badJSON
=== RUN   TestAccIAMRole_InlinePolicy_ignoreOrder
=== PAUSE TestAccIAMRole_InlinePolicy_ignoreOrder
=== RUN   TestAccIAMRole_InlinePolicy_empty
=== PAUSE TestAccIAMRole_InlinePolicy_empty
=== RUN   TestAccIAMRole_ManagedPolicy_basic
=== PAUSE TestAccIAMRole_ManagedPolicy_basic
=== RUN   TestAccIAMRole_ManagedPolicy_badARN
=== PAUSE TestAccIAMRole_ManagedPolicy_badARN
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
=== RUN   TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
=== PAUSE TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
=== RUN   TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
=== PAUSE TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
=== CONT  TestAccIAMRole_basic
=== CONT  TestAccIAMRole_MigrateFromPluginSDK_InlinePolicy
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved
=== CONT  TestAccIAMRole_badJSON
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty
=== CONT  TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack
=== CONT  TestAccIAMRole_ManagedPolicy_badARN
=== CONT  TestAccIAMRole_ManagedPolicy_basic
=== CONT  TestAccIAMRole_InlinePolicy_empty
=== CONT  TestAccIAMRole_InlinePolicy_ignoreOrder
=== CONT  TestAccIAMRole_InlinePolicy_basic
=== CONT  TestAccIAMRole_tags
=== CONT  TestAccIAMRole_permissionsBoundary
=== CONT  TestAccIAMRole_maxSessionDuration
=== CONT  TestAccIAMRole_policiesForceDetach
=== CONT  TestAccIAMRole_InlinePolicy_badJSON
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved
--- PASS: TestAccIAMRole_InlinePolicy_badJSON (63.55s)
=== CONT  TestAccIAMRole_disappears
--- PASS: TestAccIAMRole_ManagedPolicy_badARN (64.46s)
=== CONT  TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored
--- PASS: TestAccIAMRole_badJSON (82.63s)
=== CONT  TestAccIAMRole_namePrefix
--- PASS: TestAccIAMRole_InlinePolicy_empty (375.18s)
=== CONT  TestAccIAMRole_diffsCondition
--- PASS: TestAccIAMRole_policiesForceDetach (451.16s)
=== CONT  TestAccIAMRole_diffsNoCondition
--- PASS: TestAccIAMRole_basic (451.64s)
=== CONT  TestAccIAMRole_testNameChange
--- PASS: TestAccIAMRole_namePrefix (419.93s)
=== CONT  TestAccIAMRole_description
--- PASS: TestAccIAMRole_disappears (491.02s)
=== CONT  TestAccIAMRole_nameGenerated
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionIgnored (555.98s)
=== CONT  TestAccIAMRole_MigrateFromPluginSDK_basic
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemovedEmpty (620.75s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandRemovalAddedBack (620.81s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemovedEmpty (620.87s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionRemoved (621.05s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandAdditionRemoved (621.08s)
--- PASS: TestAccIAMRole_ManagedPolicy_outOfBandRemovalAddedBack (621.09s)
--- PASS: TestAccIAMRole_tags (673.45s)
--- PASS: TestAccIAMRole_MigrateFromPluginSDK_InlinePolicy (687.23s)
--- PASS: TestAccIAMRole_InlinePolicy_ignoreOrder (721.36s)
--- PASS: TestAccIAMRole_InlinePolicy_outOfBandAdditionIgnored (727.06s)
--- PASS: TestAccIAMRole_maxSessionDuration (747.98s)
--- PASS: TestAccIAMRole_ManagedPolicy_basic (794.56s)
--- PASS: TestAccIAMRole_InlinePolicy_basic (799.97s)
--- PASS: TestAccIAMRole_nameGenerated (248.10s)
--- PASS: TestAccIAMRole_testNameChange (380.26s)
--- PASS: TestAccIAMRole_description (405.59s)
--- PASS: TestAccIAMRole_permissionsBoundary (914.94s)
--- PASS: TestAccIAMRole_MigrateFromPluginSDK_basic (305.59s)
--- PASS: TestAccIAMRole_diffsCondition (552.75s)
--- PASS: TestAccIAMRole_diffsNoCondition (767.89s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/iam        1223.809s

…ne-poliy-change

justinretzolk · 2024-02-12T22:01:05Z

Hey @teddylear 👋 Thanks for taking the time to raise this, and apologies for missing your pings on the original issue. I brought this up internally as well, to try to get a bit more traction 🙂

teddylear · 2024-02-12T23:58:19Z

@justinretzolk Hey! No worries and thanks for the reply. If there's anything I need to add to change please let me know or if one of the maintainers needs to edit the branch directly that works as well. This is my first time doing a migration from sdkv2 to the plugin-framework so I may have missed something 😅. Also happy to help with more of these too as this was a good learning experience and could do for the aws_iam_role data source as well along with doing for other terraform provider resources.

…ne-poliy-change

gdavison

Thanks for submitting this, @teddylear. I have a number of comments on the PR. The biggest is that the change from inline_policy to inline_policies should be in a separate PR, and also still needs to support inline_policy because of backwards compatibility guarantees.

gdavison · 2024-04-15T21:52:45Z

internal/service/iam/role.go

+			"arn": schema.StringAttribute{
+				CustomType: fwtypes.ARNType,
+				Computed:   true,
+				Optional:   true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+				},
+			},


The arn parameter should be Computed-only, without Optional. This can also be achieved using framework.ARNAttributeComputedOnly

Suggested change

"arn": schema.StringAttribute{

CustomType: fwtypes.ARNType,

Computed: true,

Optional: true,

PlanModifiers: []planmodifier.String{

stringplanmodifier.UseStateForUnknown(),

},

},

names.AttrARN: framework.ARNAttributeComputedOnly(),

gdavison · 2024-04-15T22:25:37Z

internal/service/iam/role.go

+	TagsAll             types.Map         `tfsdk:"tags_all"`
+}
+
+func oldSDKRoleSchema() schema.Schema {


This should use the schema version instead of "old", e.g.

Suggested change

func oldSDKRoleSchema() schema.Schema {

func roleSchemaV0() schema.Schema {

gdavison · 2024-04-15T22:32:43Z

internal/service/iam/role.go

 			},
-			"inline_policy": {


Because of the backwards compatibility requirements for the provider, the inline_policy parameter cannot be removed until the next major version. The map structure that you've used for inline_policies is more user-friendly, I think, so it's definitely worth adding, and deprecating inline_policy. However, it would be better to make a separate PR for that change.

gdavison · 2024-04-15T22:37:59Z

internal/service/iam/role.go

-	// Some partitions (e.g. ISO) may not support tag-on-create.
-	partition := meta.(*conns.AWSClient).Partition
-	if input.Tags != nil && errs.IsUnsupportedOperationInPartitionError(partition, err) {
-		input.Tags = nil
-
-		output, err = retryCreateRole(ctx, conn, input)
-	}
-


This should still be supported. Not all AWS partitions support tag-on-create

gdavison · 2024-04-15T23:03:18Z

internal/service/iam/role.go

-		if v, ok := d.GetOk(names.AttrTags); (!ok || len(v.(map[string]interface{})) == 0) && errs.IsUnsupportedOperationInPartitionError(partition, err) {
-			return append(diags, resourceRoleRead(ctx, d, meta)...)
-		}
+		// if v, ok := d.GetOk(names.AttrTags); (!ok || len(v.(map[string]interface{})) == 0) && errs.IsUnsupportedOperationInPartitionError(conn.PartitionID, err) {
+		// return append(diags, resourceRoleRead(ctx, d, meta)...)
+		// }

 		if err != nil {
-			return sdkdiag.AppendErrorf(diags, "setting IAM Role (%s) tags: %s", d.Id(), err)
+			resp.Diagnostics.AddError(
+				create.ProblemStandardMessage(names.IAM, create.ErrActionCreating, fmt.Sprintf("%s tags", ResNameRole), name, nil),
+				err.Error(),
+			)
+			return


You'll need to invert the logic here, so that if len(plan.Tags.Elements()) == 0 && errs.IsUnsupportedOperationInPartitionError(conn.PartitionID, err) is true, execution falls through to the next part of the function where plan is populated.

gdavison · 2024-04-15T23:41:02Z

internal/service/iam/role.go

 }

-func deleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {
+func DeleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {


This doesn't seem to be exported

Suggested change

func DeleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {

func deleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {

gdavison · 2024-04-15T23:45:14Z

internal/service/iam/role_test.go

@@ -42,6 +43,8 @@ func TestAccIAMRole_basic(t *testing.T) {
 					testAccCheckRoleExists(ctx, resourceName, &conf),
 					resource.TestCheckResourceAttr(resourceName, "path", "/"),
 					resource.TestCheckResourceAttrSet(resourceName, "create_date"),
+					resource.TestCheckResourceAttrSet(resourceName, "unique_id"),
+					resource.TestCheckResourceAttrSet(resourceName, "arn"),


I like that you're adding a test for arn. However, you can check the specific value, e.g.

Suggested change

resource.TestCheckResourceAttrSet(resourceName, "arn"),

acctest.CheckResourceAttrGlobalARN(resourceName, "arn", "iam", fmt.Sprintf("role/%s", rName)),

,

gdavison · 2024-04-15T23:47:21Z

internal/service/iam/role_test.go

+				// NOTE: Have to update docs to reflect this because giant issue
+				// Can't not use PlanOnly anymore with terraform-plugin-testing
+				// https://github.com/hashicorp/terraform-plugin-testing/issues/256
+				ConfigPlanChecks: resource.ConfigPlanChecks{
+					PreApply: []plancheck.PlanCheck{
+						plancheck.ExpectEmptyPlan(),
+					},
+				},


What was the problem you encountered with PlanOnly? We haven't seen a problem using it

The Linked issue above describes what is happening, it was a Failed to marshal state to json: error when upgrading no matter what I did. The upstream terraform-plugin-testing plugin has updated documentation to use this instead.

gdavison · 2024-04-15T23:50:22Z

internal/service/iam/role_test.go

+// // https://github.com/hashicorp/terraform-provider-aws/issues/23288
+// // https://github.com/hashicorp/terraform-provider-aws/issues/28833
+func TestAccIAMRole_diffsNoCondition(t *testing.T) {


Suggested change

// // https://github.com/hashicorp/terraform-provider-aws/issues/23288

// // https://github.com/hashicorp/terraform-provider-aws/issues/28833

func TestAccIAMRole_diffsNoCondition(t *testing.T) {

// https://github.com/hashicorp/terraform-provider-aws/issues/23288

// https://github.com/hashicorp/terraform-provider-aws/issues/28833

func TestAccIAMRole_diffsNoCondition(t *testing.T) {

gdavison · 2024-04-16T00:04:01Z

internal/service/iam/role_test.go

+			// Test empty value
+			{
+				Config:      testAccRoleConfig_permissionsBoundary(rName, ""),
+				ExpectError: regexache.MustCompile(`Value "" cannot be parsed as an ARN.`),
+			},


We can't change the acceptable values here until the next major version. permissions_boundary will have to accept an empty string and treat it as no value. Validation should only check for a valid ARN if it's not an empty string

teddylear and others added 30 commits September 18, 2023 18:57

work so far

a2c6c14

more work so far

671450e

work so far

3a41e2d

more work

7f0cebd

more work so far

c360f78

feat: add arn framework validator

daff2f3

remove from this branch

d7d6ab3

Merge branch 'main' into ken-test-iam-plugin-sdk

970eeef

Merge branch 'f-add-arn-framwork-validator' into ken-test-iam-plugin-sdk

214c18b

force new

d223cd3

more work

dfb397d

more wokr

6795001

more steps

539b8f2

more

583fdcf

more

c241d14

fmt

090d697

progress

659682f

Merge branch 'main' into ken-test-iam-plugin-sdk

350fb1b

more work

8082f53

more cleanup

e0a75f7

adding function skeletons for plugin framework resource

29febc6

got factory working I think

495bf16

make first test simpler, added delete func

83c71d9

work so far getting read working

ed8f65a

finish read function with basics from first test

8f4eaf7

work so far to get first test working

ec1e3b4

one more try

566d85e

more

45f9e92

YES

afd6801

add back sdk resource tags

5d054f8

terraform-aws-provider bot added the needs-triage Waiting for first response or review from a maintainer. label Feb 5, 2024

teddylear added 3 commits February 4, 2024 19:57

more cleanup

9122382

cleanup test print messages

83d9b62

managed policy test

5f8fb30

teddylear changed the title ~~[WIP] aws_iam _ole upgrade to framework and inline policy change~~ [WIP] aws_iam _role upgrade to framework and inline policy change Feb 5, 2024

teddylear added 4 commits February 4, 2024 23:10

cleanup

3350161

golangci fixies

553808a

update docs

fb9bbc9

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

b0b38d4

…ne-poliy-change

teddylear marked this pull request as ready for review February 5, 2024 22:54

github-actions bot added the documentation Introduces or discusses updates to documentation. label Feb 5, 2024

teddylear added 2 commits February 5, 2024 18:08

website fix

df74c15

fmt role markdown

8b18c9e

teddylear changed the title ~~[WIP] aws_iam _role upgrade to framework and inline policy change~~ aws_iam _role upgrade to framework and inline policy change Feb 5, 2024

mbevc1 approved these changes Feb 8, 2024

View reviewed changes

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

dd23697

…ne-poliy-change

justinretzolk added bug Addresses a defect in current functionality. and removed needs-triage Waiting for first response or review from a maintainer. labels Feb 12, 2024

teddylear and others added 6 commits March 11, 2024 20:36

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

fee01ed

…ne-poliy-change

chore: fix semgrep error with test error check

a4bf59b

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

c5ef984

…ne-poliy-change

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

9d7b8ff

…ne-poliy-change

remove autogen tags

9277bf2

Merge branch 'main' into f-aws_iam_role-upgrade-to-framework-and-inli…

517bf67

…ne-poliy-change

teddylear mentioned this pull request Apr 11, 2024

[Bug]: make gen saids no no type name: error when type name is set #36875

Closed

gdavison requested changes Apr 16, 2024

View reviewed changes

ewbankkit added the breaking-change Introduces a breaking change in current functionality; usually deferred to the next major release. label Jul 24, 2024

jar-b mentioned this pull request Sep 10, 2024

Changes to inline_policy blocks on aws_iam_role always recreates policy #22336

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

aws_iam _role upgrade to framework and inline policy change #35634

aws_iam _role upgrade to framework and inline policy change #35634

teddylear commented Feb 5, 2024 •

edited

Loading

justinretzolk commented Feb 12, 2024

teddylear commented Feb 12, 2024

gdavison left a comment

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

gdavison Apr 15, 2024

teddylear Apr 17, 2024

gdavison Apr 15, 2024

gdavison Apr 16, 2024

	func oldSDKRoleSchema() schema.Schema {
	func roleSchemaV0() schema.Schema {

	func DeleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {
	func deleteRole(ctx context.Context, conn *iam.Client, roleName string, forceDetach, hasInline, hasManaged bool) error {

	resource.TestCheckResourceAttrSet(resourceName, "arn"),
	acctest.CheckResourceAttrGlobalARN(resourceName, "arn", "iam", fmt.Sprintf("role/%s", rName)),
	,

aws_iam _role upgrade to framework and inline policy change #35634

Are you sure you want to change the base?

aws_iam _role upgrade to framework and inline policy change #35634

Conversation

teddylear commented Feb 5, 2024 • edited Loading

Description

Relations

Output from Acceptance Testing

justinretzolk commented Feb 12, 2024

teddylear commented Feb 12, 2024

gdavison left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

teddylear commented Feb 5, 2024 •

edited

Loading