Error when creating trust policy

[amitsaha]

Hello, I am following the README and while trying to create a trust policy as follows:

+ aws_iam_role_policy.SomePolicy
    name:   "SomeRole"
    policy: "{
  \"Version\": \"2012-10-17\",
  \"Statement\": [
    {
      \"Sid\": \"\",
      \"Effect\": \"Allow\",
      \"Action\": \"sts:AssumeRole\",
      \"Principal\": {
        \"AWS\": \"arn:aws:iam::<account-id>:root\",
        \"Service\": \"ec2.amazonaws.com\"
      }
    }
  ]
}"
    role:   "Role_name"

I get the following:

MalformedPolicyDocument: Policy document should not specify a principal.

FWIW, I am doing this via Terraform:

data "aws_iam_policy_document" "trust-assume-role-policy" {
  statement {

   actions = ["sts:AssumeRole"]

   principals {
     type        = "Service"
     identifiers = ["ec2.amazonaws.com"]
   }   

   principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::<account-id>:root"]
   }   
  }
}

resource "aws_iam_role_policy" "TrustUser" {
  name   = "TrustUser"
  role   = "SomeRole"
  policy = "${data.aws_iam_policy_document.trust-assume-role-policy.json}"
}

Not sure what I am doing wrong here. Any suggestions?

I could update the relationship using the Web UI, but not able to do via Terraform. Filed an issue with Terraform as well. https://github.com/hashicorp/terraform/issues/13449

[ryan-lane]

I think you need to specify this as multiple statements, rather than having both principals in the same statement.

[amitsaha]

@ryan-lane thanks for the response. It didn't work, i get the same error. Do you have any other ideas? Not sure, probably it's a Terraform bug.

Thanks.

[ryan-lane]

Not totally sure. May want to ask the terraform folks for help. We're using saltstack for aws orchestration and the trust policies we define like this are working (though we have ours listed as multiple statements).

[ryan-lane]

Going to close this out, since it's not directly related to metadataproxy.

[eric-aldinger]

The answer is the documentation is off a bit for Terraform. Include your principals in an identifiers array.

data "aws_iam_policy_document" "report_ami_principals"{
  statement {
    actions =  ["sts:AssumeRole"],
    principals {
      type = "Service"
      identifiers = [
        "ec2.amazonaws.com",
        "events.amazonaws.com",
        "logs.us-west-1.amazonaws.com",
        "logs.us-west-2.amazonaws.com",
        "logs.us-east-1.amazonaws.com",
        "logs.us-east-2.amazonaws.com",
        "rds.amazonaws.com",
        "s3.amazonaws.com",
        "monitoring.rds.amazonaws.com",
      ]
    }
  }
}