Terraform panic: interface conversion: interface {} is []interface {}, not string

[Sarah-E-Greene]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

0.12.10

Affected Resource(s)

• plugin.terraform-provider-aws_v2.32.0_x4
• aws_config_config_rule

We also see this in:

• aws_cloudwatch_event_target

(i can go back and get this trace if you need it)

• An output with a value of aws_s3_bucket.cloudtrail.id:

2019/10/16 20:53:46 [TRACE] EvalWriteOutput: Saving Create change for module.logs_prod.output.cloudtrail_bucket_name in changeset
2019-10-16T20:53:46.758Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4: panic: interface conversion: interface {} is []interface {}, not string
2019-10-16T20:53:46.758Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4:
2019-10-16T20:53:46.758Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4: goroutine 158 [running]:
2019-10-16T20:53:46.759Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4: github.com/jen20/awspolicyequivalence.newAWSStringSet(0x3c8d1e0, 0xc0009e2820, 0xc0000c6dc0
, 0xb, 0xb)
2019-10-16T20:53:46.759Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4:      /opt/teamcity-agent/work/5d79fe75d4460a2f/pkg/mod/github.com/jen20/awspolicyequivalenc
e@v1.0.0/aws_policy_equivalence.go:386 +0x212
2019-10-16T20:53:46.759Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4: github.com/jen20/awspolicyequivalence.(*awsPolicyStatement).equals(0xc0003b86c0, 0xc0003b89
90, 0x0)
2019-10-16T20:53:46.759Z [DEBUG] plugin.terraform-provider-aws_v2.32.0_x4:      /opt/teamcity-agent/work/5d79fe75d4460a2f/pkg/mod/github.com/jen20/awspolicyequivalenc
e@v1.0.0/aws_policy_equivalence.go:176 +0x2d8
2019-10-16T20:53:46.758Z [DEBUG] plugin: plugin process exited: path=/workdir/terraform/.terraform/plugins/linux_amd64/terraform-provider-aws_v2.32.0_x4 pid=500

Terraform Configuration Files

resource "aws_config_config_rule" "encrypted_volumes" {
  name        = "encrypted-volumes"
  description = "Checks whether EBS volumes that are in an attached state are encrypted."

  source {
    owner             = "AWS"
    source_identifier = "ENCRYPTED_VOLUMES"
  }

  depends_on = [aws_config_configuration_recorder.config_recorder]
}

Panic Output

https://gist.github.com/SarahRiley/9cf34603de6daea93ce20bc13a703c66

Expected Behavior

A plan

Actual Behavior

A crash

Steps to Reproduce

1. terraform apply

[ewbankkit]

@SarahRiley Can you please paste an example of the IAM policy (sanitized where necessary of cource) on the config recorder that is causing this panic.
I see the line of code where the panic is raised but would like to get an understanding of the structure of the IAM policy.
Thanks.

[Sarah-E-Greene]

Certainly, here is the relevant code:

resource "aws_config_configuration_recorder" "config_recorder" {
  name     = "Configuration-Recorder"
  role_arn = aws_iam_role.aws_config.arn
}

resource "aws_iam_role" "aws_config" {
  name = "aws-config"

  assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "config.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
POLICY

}

resource "aws_iam_role_policy" "aws_config" {
  name = "aws-config"
  role = aws_iam_role.aws_config.id

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "${aws_s3_bucket.aws_config.arn}",
        "${aws_s3_bucket.aws_config.arn}/*"
      ]
    }
  ]
}
POLICY

}

resource "aws_iam_role_policy_attachment" "aws_config" {
  role       = aws_iam_role.aws_config.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSConfigRole"
}

# S3

resource "aws_s3_bucket" "aws_config" {
  bucket = "REDACTED"
  acl    = "private"
  region = var.aws_region
}

[ewbankkit]

Similar:

• Crash during plan migrating to 0.12 #10135

[ewbankkit]

Submitted upstream PR jen20/awspolicyequivalence#9 to fix the panic, but this won't fix the underlying issue and will probably result in a run time MalformedPolicyDocument: Syntax errors in policy. error.

[Sarah-E-Greene]

Interesting. Where’s the problem in the policy, if you don’t mind? This was upgraded from 0.11 code originally, where it was valid.

[Sarah-E-Greene]

OK, I've narrowed down the problem to this:

resource "aws_iam_role_policy" "vulnerability_scanning_iam_policy" {
  count = var.fargate_enabled ? 1 : 0

  name = "vulnerability-scanning-iam-policy"

  role = module.elastic_spyglass_fargate.iam_role_id

  policy = <<EOF
{
	"Version": "2012-10-17",
	"Statement": [{
			"Effect": "Allow",
			"Action": "sts:AssumeRole",
			"Resource": ${jsonencode(local.scanned_account_id_list)}
		},
...
EOF

locals {
  scanned_account_id_list = [formatlist(
    "arn:aws:iam::%s:role/${module.elastic_spyglass_fargate.iam_role_id}",
    var.scanned_account_ids,
  )]
}

variable "scanned_account_ids" {
  type = list(string)

  default = []
}
}

Removing the outer []s for local.scanned_account_id_list fixed it.

[ewbankkit]

@SarahRiley Thanks for diving into this. The list-in-a-list was the same error as in #10135 but we should still get the the PR to stop the panic merged.
Could you please close this issue?

[Sarah-E-Greene]

Agreed. Thanks!

[bflad]

The fix for this has been merged and will release with version 2.42.0 of the Terraform AWS Provider, likely next week. 👍

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

[ghost]

This has been released in version 2.42.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!