aws_iam_instance_profile: wrong behaviour of 'role' attribute

[Avolynsk]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.13
provider.aws v2.6.0

Affected Resource(s)

• aws_iam_instance_profile

Terraform Configuration Files

provider "aws" {
  region = "us-east-1"
}

terraform {
  backend "consul" {
    address = "consul.host.name:port"
    scheme  = "http"
    path    = "terraform/iam-test"
  }
}

resource "aws_iam_role" "FakeRole1" {
    name               = "FakeRole1"
    path               = "/"
    max_session_duration = "3600"
    force_detach_policies = ""
    assume_role_policy = <<POLICY
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::XXXXXXXXXXXX:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
POLICY
}

resource "aws_iam_instance_profile" "FakeProfile1" {
    name = "FakeInstanceProfile1"
    path = "/"
    role = "${aws_iam_role.FakeRole1.name}"
}

Debug Output

https://gist.github.com/Avolynsk/31f1cda9293da47698ff8f346392faa8

Panic Output

Expected Behavior

terraform apply should re-add IAM role to the IAM instance profile

Actual Behavior

terraform does't re-add IAM role to the IAM instance profile

Steps to Reproduce

1. terraform apply - this is a cold start, all resources will be created in AWS
2. Delete AWS role 'FakeRole1' via web-ui - simulating accident role deletion by any of users.
3. terraform apply - will re-create 'FakeRole1', but 'Instance Profile ARNs' will be blank - the role will not be attached to the initial 'FakeInstanceProfile1'

If replace role attribute with roles in aws_iam_instance_profile definition - all works as expected, IAM role will be re-added to th Instance profile.

Important Factoids

References

• iam_instance_profile not updating roles #1270

[ryndaniels]

Hi @Avolynsk - Thanks for taking the time to submit this issue. I had a look at this with the most recent versions of Terraform and the AWS Provider (0.12.13 and 2.38.0 as of right now) and was unable to reproduce this behavior. We’re going to close this issue for now, but if you run into this again with the latest Terraform and Provider versions, please feel free to open a new issue. 🙂

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!