Module Issues w/ Terraform v0.13.0

[cazter]

After upgrading to Terraform v0.13.0, the module errors out with refresh/plan/apply.

• Upgraded to tf v0.13.0
• Ran tf init
• Backend stored in S3 bucket failed, requiring reconfigure. Ran tf init -reconfigure
• Running tf refresh/plan/apply fails with error from module (details below).

I'm submitting a...

• bug report

What is the current behavior?

On tf refresh/plan/apply, I get the following error for each worker:

    Error: Invalid resource instance data in state

      on ../../../modules/k8s/workers.tf line 390:
     390: resource "aws_iam_instance_profile" "workers" {

    Instance module.eks.aws_iam_instance_profile.workers[4] data could not be
    decoded from the state: unsupported attribute "roles".

From tfstate:

  "module": "module.eks",
  "mode": "managed",
  "type": "aws_iam_instance_profile",
  "name": "workers",
  "each": "list",
  "provider": "provider.aws",
  "instances": [
    {
      "index_key": 0,
      "schema_version": 0,
      "attributes": {
        "arn": "arn:aws:iam::xxxxxxxx:instance-profile/eks-cxxxxxxxx",
        "create_date": "2019-07-13T16:40:52Z",
        "id": "eks-cxxxxxxxx",
        "name": "eks-cxxxxxxxx",
        "name_prefix": "eks-c",
        "path": "/",
        "role": "eks-cxxxxxxxx",
        "roles": [
          "eks-cxxxxxxxx"
        ],
        "unique_id": "xxxxxxxx"
      },
      "private": "xxxxx",
      "dependencies": [
        "aws_security_group.eks-node-group-mgmt1",
        "module.eks.aws_cloudwatch_log_group.this",
        "module.eks.aws_eks_cluster.this",
        "module.eks.aws_iam_role.cluster",
        "module.eks.aws_iam_role.workers",
        "module.eks.aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy",
        "module.eks.aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy",
        "module.eks.aws_security_group.cluster",
        "module.vpc.aws_vpc.eks"
      ]
    },

[dpiddockcmp]

I think this is an aws provider v3 issue:
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/version-3-upgrade#resource-aws_iam_instance_profile

Can you try again but lock your AWS provider to version 2? e.g.

provider "aws" {
  version = "~> 2.0"
}

[dpiddockcmp]

Oops. The roles attribute has been deprecated since TF 0.9.3

[cazter]

Thanks @dpiddockcmp

I am sure that tainting these resources would have been the more elegant solution. But I just went ahead and manually edited the .tfstate, removing this attribute.

[dpiddockcmp]

It looks like this might be a bungled schema update. Normally the provider should handle migrations like this. Hopefully it will get automatically fixed for other users in TF 0.13.1: hashicorp/terraform#25779

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.