[Enhancement]: aws_iam_service_linked_role adopt existing resource

[sidekick-eimantas]

Description

Multiple aws_iam_service_linked_role's are created automatically by AWS when an account is opened. Namely the "organizations.amazonaws.com", "support.amazonaws.com" and "trustedadvisor.amazonaws.com". As part of an account setup, we try to create those service linked roles, and a few others. Those three however fail as they already exist. Importing them is too inconvenient in fully CI/CD'd setups. Would be great if the aws_iam_service_linked_role resource could automatically adopt an existing service linked role.

Affected Resource(s) and/or Data Source(s)

• aws_iam_service_linked_role

Potential Terraform Configuration

No response

References

No response

Would you like to implement a fix?

None

[github-actions[bot]]

Community Note

Voting for Prioritization

• Please vote on this issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize this request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.

[gdavison]

Thanks for filing this, @sidekick-eimantas. I was about to do the same.

[timsutton]

Would be great if the aws_iam_service_linked_role resource could automatically adopt an existing service linked role.

I had a similar thought. Is there a workaround that might be usable today? As in to maybe try importing an existing IAM role with the expected name, and then invoke this role conditionally if a resource could be imported?

[WolverineFan]

NOTE: If someone implements this, the adopted resource should NOT be deleted with a terraform destroy. It would be quite possible that multiple modules/state files would end up referencing the same adopted resource, and if you ran a destroy on just one of them it would break them all. An example of that is the AWSServiceRoleForAutoScaling role, which might be "created" alongside every autoscaling group, but shouldn't be destroyed or it will impact ALL autoscaling groups.

[WolverineFan]

Would be great if the aws_iam_service_linked_role resource could automatically adopt an existing service linked role.

I had a similar thought. Is there a workaround that might be usable today? As in to maybe try importing an existing IAM role with the expected name, and then invoke this role conditionally if a resource could be imported?

You could maybe use an import block in Terraform 1.5+ but you would hit the problem I describe in my comment above where the imported resource would be destroyed and that may not be what you want.