aws_iam_instance_profile incorrectly requires a role to be specified

[daveadams]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.12.10
+ provider.aws v2.28.1

Affected Resource(s)

• aws_iam_instance_profile

Terraform Configuration Files

resource "aws_iam_instance_profile" "test" {
  name = "test"
}

Expected Behavior

Terraform should create an instance-profile named "test" with no role attached.

Actual Behavior

Error: Either `role` or `roles` (deprecated) must be specified when creating an IAM Instance Profile

  on main.tf line 1, in resource "aws_iam_instance_profile" "test":
   1: resource "aws_iam_instance_profile" "test" {

Steps to Reproduce

1. terraform apply
2. View and approve the presented plan by typing yes
3. Receive error message

Important Factoids

The aws_iam_instance_profile documentation does say that "Either role or roles (deprecated) must be specified." But specifying role = "" gets the same error, and specifying roles = [] gets a deprecation warning during the planning stage of terraform apply, followed by the same error after approving the plan.

But it's entirely possible to create and use an instance profile with no role via the IAM and EC2 APIs:

{
    "InstanceProfile": {
        "Path": "/",
        "InstanceProfileName": "testing",
        "InstanceProfileId": "AIPAABCD1234ABCD1234ABCD",
        "Arn": "arn:aws:iam::000011112222:instance-profile/testing",
        "CreateDate": "2019-10-16T16:22:05Z",
        "Roles": []
    }
}

This role-free instance-profile can be attached to an instance and used as metadata--to authenticate to Vault, for example.

Without this capability, I'm forced to create and attach a do-nothing role to my instance-profile instead.

[ghost]

This has been released in version 2.39.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

[daveadams]

Fantastic! Thanks, @aeschright !!

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!