garthk
commented
4 years ago It's not quite #21588 because I'm not within cooee of a module output.
Figured out it's to do with the gymnastics I'm having to pull to add an extra statement to an assume_role_policy only if an input variable is set:
locals {
assume_by_lambda = {
Sid = "AssumeByLambda"
Effect = "Allow"
Principal = {
Service = "lambda.amazonaws.com"
}
Action = "sts:AssumeRole"
Condition = {
NotIpAddress = {
"aws:SourceIp" = "127.0.0.1/32"
}
}
}
assume_by_account = {
Sid = "AssumeByIAMInSameAccount"
Effect = "Allow"
Principal = {
AWS = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"
}
Action = "sts:AssumeRole"
Condition = {
Bool = {
"aws:MultiFactorAuthPresent" = "true"
}
}
}
assume_role_policy = {
Version = "2012-10-17"
Statement = var.account_may_assume ? [local.assume_by_lambda, local.assume_by_account] : [local.assume_by_lambda]
}
}
resource "aws_iam_role" "lambda" {
name = var.name
assume_role_policy = jsonencode(local.assume_role_policy)
}If I remove the dummy Condition from assume_by_lambda, I get:
Error: Inconsistent conditional result types
on ../modules/mymodule/main.tf line 32, in locals:
32: Statement = var.account_may_assume ? [local.assume_by_lambda, local.assume_by_account] : [local.assume_by_lambda]
|----------------
| local.assume_by_account is object with 5 attributes
| local.assume_by_lambda is object with 4 attributesIf I set Condition = null and account_may_assume is true, I get the crash above.
danieldreier
ghost
Terraform Version
Terraform v0.12.21
Terraform Configuration Files, Debug Output, Crash Output
I regret I can't post these in public and lack the time right now to redact them.
Expected Behavior
It would have been nice if
terraform applyhad succeeded.Actual Behavior
Steps to Reproduce
terraform apply