hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.96k stars 9.23k forks source link

[Bug]: aws_sns_topic fails to plan if the deployed resource policy references IAM roles which have been deleted or recreated #38178

Open rhowe opened 5 months ago

rhowe commented 5 months ago

Terraform Core Version

1.5.7

AWS Provider Version

5.10.0

Affected Resource(s)

Expected Behavior

A broken policy should have been retrieved from AWS without causing the plan to fail

Actual Behavior

The Terraform run failed with an error when preparing the plan

Relevant Error/Panic Output Snippet

Error: reading SNS Topic (arn:...): contains invalid principals

Terraform Configuration Files

# This has been hand-copied from a restricted environment I can't copy & paste from
# It might have a few silly errors but hopefully is still useful

resource "aws_iam_role" "role" {
  name = "role"
}

resource "aws_sns_topic" "topic" {
  name = "mytopic"
  display_name = "mytopic"
}

resource "aws_sns_topic_policy" "policy" {
  arn = aws_sns_topic.topic.arn
  policy = jsonencode({
  Id = "topic-policy"
  Statement = [{
    Sid = "sid"
    Action = "sns:Subscribe"
    Effect = "Allow"
    Principal = {
      AWS = aws_iam_role.role.arn
    }
    Resource = aws_sns_topic.topic.arn
  ]})
}

Steps to Reproduce

This is an approximation of what I was doing to trigger the issue

terraform apply
terraform -target aws_sns_topic.topic plan # Expect to succeed
terraform -target aws_iam_role.role destroy
terraform -target aws_sns_topic.topic plan # Expect to fail when reading the existing topic policy
terraform -target aws_iam_role.role apply
terraform -target aws_sns_topic.topic plan # Expect to fail when reading the existing topic policy

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None

github-actions[bot] commented 5 months ago

Community Note

Voting for Prioritization

Volunteering to Work on This Issue

rhowe commented 5 months ago

Also confirmed on provider 5.55.0