Closed shawn-sterling closed 1 year ago
I'm seeing a very similar issue resulting from a complex use of aws_iam_policy_document
resources which are tied back to json output.
Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.
If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Community Note
Description
Hello Terraform friends.
I'm running the below code, and every time it runs it looks like something has changed, where it's just moving things around.
I've run with TF_LOG=TRACE and extracted the urlencoded value we are sending to AWS and it looks fine to me. If I paste that into the AWS web console it works fine. If I run with
aws iam update-assume-role-policy --role-name tmp-1 --policy-doc this_doc.json
it works fine.
I do see this warning in the trace logs (linked below)
The values are generated via terragrunt and we've tried jsonencoding the assume_role_policy as well, but that results in an error. The 2nd and 3rd policy were split out as a troubleshooting step, they used to be just 1; but this results in the same issue. Looks like a change being applied every time we run. Have also sorted the values generated for the accounts but this has no effect.
This could be bad policydoc, but I've applied via cli and webconsole and it goes in just fine.
Please halp. ;)
Terraform CLI and Terraform AWS Provider Version
Affected Resource(s)
Terraform Configuration Files
Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.
Debug Output
https://gist.github.com/shawn-sterling/a08655c9dc03e77b1806544fbf6c862f#file-tf-trace-log
Expected Behavior
terraform should create the role + assume role in a idempotent way so future runs do not look like they have changes.
Actual Behavior
Every time we run terraform it applies a "new" change (it moves around a few values).
Steps to Reproduce
terraform apply -var-file test.json
terraform apply -var-file test.json
Important Factoids
N/A
References
N/A