-
Notifications
You must be signed in to change notification settings - Fork 9.1k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Secrets manager policy validation fails for principals that are just created #14449
Comments
The fix for this has been merged and will release with version 3.1.0 of the Terraform AWS Provider, likely later today. Thanks to @DrFaust92 for the implementation. 👍 |
@DrFaust92 thanks for the prompt implementation :) |
This has been released in version 3.1.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading. For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks! |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks! |
Community Note
Terraform CLI and Terraform AWS Provider Version
Terraform v0.12.16
Affected Resource(s)
Terraform Configuration Files
Debug Output
Panic Output
Expected Behavior
Secret is generated with the appropriate permission at the first apply
Actual Behavior
The validation for the policy fails with the following output
data.aws_caller_identity.current: Refreshing state...
aws_iam_role.this: Creating...
aws_iam_role.this: Creation complete after 2s [id=instance-profile-test]
data.aws_iam_policy_document.this: Refreshing state...
aws_secretsmanager_secret.this: Creating...
Error: error setting Secrets Manager Secret "arn:aws:secretsmanager:ap-southeast-2:XXXXXXX: secret:test-e5XYyU" policy: MalformedPolicyDocumentException: This resource policy contains an unsupported principal.
on main.tf line 6, in resource "aws_secretsmanager_secret" "this":
6: resource "aws_secretsmanager_secret" "this" {
NOTE: a subsequent apply works as expected. I suspect the validation of the policy happens before the IAM role arn is actually available for querying due to IAM eventual consistency
Steps to Reproduce
terraform destroy
terraform apply
--> Generate an errorterraform apply
--> Successful executionThe text was updated successfully, but these errors were encountered: