instance_profile.role not updated when role detached

[macropin]

The instance_profile attached role does not get updated in the state when the role is detached via other means.

See:

Ref: https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/iam/instance_profile.go#L262
Ref: https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/iam/instance_profile.go#L323

When the role is removedlen(instanceProfile.Roles) == 0 so the update code block never runs.

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.2.4
on darwin_amd64
+ provider registry.terraform.io/hashicorp/aws v4.21.0

Affected Resource(s)

• aws_iam_instance_profile

Terraform Configuration Files

# Terraform fails to detect the detachment of a Role from the Instance Profile.
#
# To reproduce,
# 1) terraform plan / apply
# 2) detach the role from the Instance Profile using the AWS cli ($ aws iam remove-role-from-instance-profile --instance-profile-name my-profile --role-name instanceRole)
# 3) run terraform plan and note that terraform does not detect the change
#
# To reattach run $ aws iam add-role-to-instance-profile --instance-profile-name my-profile --role-name instanceRole
#
# Reproduced with hashicorp/aws v4.21.0, and Terraform v1.2.4

resource "aws_iam_instance_profile" "profile" {
  name = "my-profile"
  role = aws_iam_role.role.name
}

resource "aws_iam_role" "role" {
  name = "instanceRole"
  path = "/"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Principal": {
               "Service": "ec2.amazonaws.com"
            },
            "Effect": "Allow",
            "Sid": ""
        }
    ]
}
EOF
}

resource "aws_instance" "instance" {
  ami                  = data.aws_ami.ubuntu.id
  instance_type        = "t3.micro"
  iam_instance_profile = aws_iam_instance_profile.profile.id
}

data "aws_ami" "ubuntu" {
  most_recent = true

  filter {
    name   = "name"
    values = ["ubuntu/images/hvm-ssd/ubuntu-focal-20.04-amd64-server-*"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }

  owners = ["099720109477"] # Canonical
}

Expected Behavior

Terraform fails to notice the change in state. It is expected that terraform plan
would reconcile the state change.

Actual Behavior

The detachment of the Role was not reflected in the state when planning.

[justinretzolk]

Hey @macropin 👋 Thanks for taking the time to submit this issue. It looks like this is a duplicate of #24540. We like to try to keep discussions consolidated, so we’re going to close this new issue in favor of #24540.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.