fix: Invalid repo policy due to IAM eventual consistency

aws/resource_aws_ecr_repository_policy.go

@@ -2,10 +2,12 @@ package aws
 
 import (
 	"log"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/ecr"
+	"github.com/hashicorp/terraform/helper/resource"
 	"github.com/hashicorp/terraform/helper/schema"
 )
 
@@ -43,7 +45,19 @@ func resourceAwsEcrRepositoryPolicyCreate(d *schema.ResourceData, meta interface
 	}
 
 	log.Printf("[DEBUG] Creating ECR resository policy: %s", input)
-	out, err := conn.SetRepositoryPolicy(&input)
+
+	// Retry due to IAM eventual consistency
+	var out *ecr.SetRepositoryPolicyOutput
+	err := resource.Retry(2*time.Minute, func() *resource.RetryError {
+		var err error
+		out, err = conn.SetRepositoryPolicy(&input)
+
+		if isAWSErr(err, "InvalidParameterException", "Invalid repository policy provided") {
+			return resource.RetryableError(err)
+
+		}
+		return resource.NonRetryableError(err)
+	})
 	if err != nil {
 		return err
 	}
@@ -102,7 +116,20 @@ func resourceAwsEcrRepositoryPolicyUpdate(d *schema.ResourceData, meta interface
 		PolicyText:     aws.String(d.Get("policy").(string)),
 	}
 
-	out, err := conn.SetRepositoryPolicy(&input)
+	log.Printf("[DEBUG] Updating ECR resository policy: %s", input)
+
+	// Retry due to IAM eventual consistency
+	var out *ecr.SetRepositoryPolicyOutput
+	err := resource.Retry(2*time.Minute, func() *resource.RetryError {
+		var err error
+		out, err = conn.SetRepositoryPolicy(&input)
+
+		if isAWSErr(err, "InvalidParameterException", "Invalid repository policy provided") {
+			return resource.RetryableError(err)
+
+		}
+		return resource.NonRetryableError(err)
+	})
 	if err != nil {
 		return err
 	}

aws/resource_aws_ecr_repository_policy_test.go

@@ -27,6 +27,22 @@ func TestAccAWSEcrRepositoryPolicy_basic(t *testing.T) {
 	})
 }
 
+func TestAccAWSEcrRepositoryPolicy_iam(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcrRepositoryPolicyDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcrRepositoryPolicyWithIAMRole,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcrRepositoryPolicyExists("aws_ecr_repository_policy.default"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSEcrRepositoryPolicyDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ecrconn
 
@@ -90,3 +106,57 @@ resource "aws_ecr_repository_policy" "default" {
 EOF
 }
 `
+
+// testAccAWSEcrRepositoryPolicyWithIAMRole creates a new IAM Role and tries
+// to use it's ARN in an ECR Repository Policy. IAM changes need some time to
+// be propagated to other services - like ECR. So the following code should
+// exercise our retry logic, since we try to use the new resource instantly.
+var testAccAWSEcrRepositoryPolicyWithIAMRole = `
+provider "aws" {
+	region = "us-east-1"
+}
+
+resource "aws_ecr_repository" "foo" {
+	name = "bar"
+}
+
+resource "aws_iam_role" "foo" {
+  name = "bar"
+
+  assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": "sts:AssumeRole",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "ec2.amazonaws.com"
+      }
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_ecr_repository_policy" "default" {
+	repository = "${aws_ecr_repository.foo.name}"
+	policy = <<EOF
+{
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Sid": "testpolicy",
+            "Effect": "Allow",
+            "Principal": {
+              "AWS": "${aws_iam_role.foo.arn}"
+            },
+            "Action": [
+                "ecr:ListImages"
+            ]
+        }
+    ]
+}
+EOF
+}
+`