aws_cloudformation_stack: use retry logic on IAM role error

.changelog/22840.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+resource/aws_cloudformation_stack: Retry resource Create and Update for IAM eventual consistency
+```

internal/service/cloudformation/stack.go

@@ -13,7 +13,9 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	"github.com/hashicorp/terraform-provider-aws/internal/conns"
 	"github.com/hashicorp/terraform-provider-aws/internal/flex"
+	tfiam "github.com/hashicorp/terraform-provider-aws/internal/service/iam"
 	tftags "github.com/hashicorp/terraform-provider-aws/internal/tags"
+	"github.com/hashicorp/terraform-provider-aws/internal/tfresource"
 	"github.com/hashicorp/terraform-provider-aws/internal/verify"
 )
 
@@ -181,14 +183,32 @@ func resourceStackCreate(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	log.Printf("[DEBUG] Creating CloudFormation Stack: %s", input)
-	output, err := conn.CreateStack(input)
+
+	err := resource.Retry(tfiam.PropagationTimeout, func() *resource.RetryError {
+		output, err := conn.CreateStack(input)
+		if tfawserr.ErrMessageContains(err, "ValidationError", "is invalid or cannot be assumed") {
+			return resource.RetryableError(err)
+		}
+
+		if err != nil {
+			return resource.NonRetryableError(err)
+		}
+
+		d.SetId(aws.StringValue(output.StackId))
+		return nil
+	})
+
+	var output *cloudformation.CreateStackOutput
+
+	if tfresource.TimedOut(err) {
+		output, err = conn.CreateStack(input)
+		d.SetId(aws.StringValue(output.StackId))
+	}
 
 	if err != nil {
 		return fmt.Errorf("error creating CloudFormation Stack (%s): %w", name, err)
 	}
 
-	d.SetId(aws.StringValue(output.StackId))
-
 	if _, err := WaitStackCreated(conn, d.Id(), requestToken, d.Timeout(schema.TimeoutCreate)); err != nil {
 		return fmt.Errorf("error waiting for CloudFormation Stack (%s) create: %w", d.Id(), err)
 	}
@@ -359,7 +379,24 @@ func resourceStackUpdate(d *schema.ResourceData, meta interface{}) error {
 	}
 
 	log.Printf("[DEBUG] Updating CloudFormation stack: %s", input)
-	_, err := conn.UpdateStack(input)
+
+	err := resource.Retry(tfiam.PropagationTimeout, func() *resource.RetryError {
+		_, err := conn.UpdateStack(input)
+		if tfawserr.ErrMessageContains(err, "ValidationError", "is invalid or cannot be assumed") {
+			return resource.RetryableError(err)
+		}
+
+		if err != nil {
+			return resource.NonRetryableError(err)
+		}
+
+		return nil
+	})
+
+	if tfresource.TimedOut(err) {
+		_, err = conn.UpdateStack(input)
+	}
+
 	if tfawserr.ErrMessageContains(err, "ValidationError", "No updates are to be performed.") {
 		log.Printf("[DEBUG] Current CloudFormation stack has no updates")
 	} else if err != nil {

internal/service/cloudformation/stack_test.go

@@ -444,6 +444,27 @@ func TestAccCloudFormationStack_onFailure(t *testing.T) {
 	})
 }
 
+func TestAccCloudFormationStack_withIAM(t *testing.T) {
+	var stack cloudformation.Stack
+	rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
+	resourceName := "aws_cloudformation_stack.test"
+
+	resource.ParallelTest(t, resource.TestCase{
+		PreCheck:     func() { acctest.PreCheck(t) },
+		ErrorCheck:   acctest.ErrorCheck(t, cloudformation.EndpointsID),
+		Providers:    acctest.Providers,
+		CheckDestroy: testAccCheckDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccStackConfig_withIAM(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckCloudFormationStackExists(resourceName, &stack),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckCloudFormationStackExists(n string, stack *cloudformation.Stack) resource.TestCheckFunc {
 	return func(s *terraform.State) error {
 		rs, ok := s.RootModule().Resources[n]
@@ -1011,3 +1032,62 @@ resource "aws_cloudformation_stack" "test" {
 }
 `, rName)
 }
+
+func testAccStackConfig_withIAM(rName string) string {
+	return fmt.Sprintf(`
+data "aws_iam_policy_document" "test" {
+  statement {
+    actions = ["sts:AssumeRole"]
+    principals {
+      type        = "Service"
+      identifiers = ["cloudformation.amazonaws.com"]
+    }
+  }
+}
+
+resource "aws_iam_role" "test" {
+  assume_role_policy = data.aws_iam_policy_document.test.json
+}
+
+resource "aws_iam_policy" "test" {
+  policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Effect   = "Allow"
+        Action   = ["s3:*"]
+        Resource = "*"
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy_attachment" "test" {
+  policy_arn = aws_iam_policy.test.arn
+  role       = aws_iam_role.test.name
+}
+
+data "aws_iam_role" "test" {
+  # This is introduced so the aws_cloudformation_stack has a dependency on the role_attachment
+  # instead of the role directly. Without it, the policy may not exist before cloudformation
+  # has a chance to delete it's resources
+  name = aws_iam_role_policy_attachment.test.role
+}
+
+resource "aws_cloudformation_stack" "test" {
+  name = %[1]q
+
+  on_failure   = "DO_NOTHING"
+  iam_role_arn = aws_iam_role.test.arn
+
+  template_body = jsonencode({
+    AWSTemplateFormatVersion = "2010-09-09"
+    Resources = {
+      S3Bucket = {
+        Type = "AWS::S3::Bucket"
+      }
+    }
+  })
+}
+`, rName)
+}