From 669d196a58718da919b74fdcf003b1177d302f61 Mon Sep 17 00:00:00 2001
From: Radek Simko <radek.simko@gmail.com>
Date: Sun, 23 Aug 2015 13:48:16 +0100
Subject: [PATCH] ecs_service: Role name can be used in iam_role (ARN was
 supported)

 - fixes #2722
---
 .../providers/aws/resource_aws_ecs_service.go |  13 ++-
 .../aws/resource_aws_ecs_service_test.go      | 109 ++++++++++++++++++
 2 files changed, 121 insertions(+), 1 deletion(-)

diff --git a/builtin/providers/aws/resource_aws_ecs_service.go b/builtin/providers/aws/resource_aws_ecs_service.go
index cf8e47a53c64..9651412a8a3b 100644
--- a/builtin/providers/aws/resource_aws_ecs_service.go
+++ b/builtin/providers/aws/resource_aws_ecs_service.go
@@ -178,8 +178,14 @@ func resourceAwsEcsServiceRead(d *schema.ResourceData, meta interface{}) error {
 	d.Set("desired_count", *service.DesiredCount)
 	d.Set("cluster", *service.ClusterArn)
 
+	// Save IAM role in the same format
 	if service.RoleArn != nil {
-		d.Set("iam_role", *service.RoleArn)
+		if strings.HasPrefix(d.Get("iam_role").(string), "arn:aws:iam:") {
+			d.Set("iam_role", *service.RoleArn)
+		} else {
+			roleARN := buildIamRoleNameFromARN(*service.RoleArn)
+			d.Set("iam_role", roleARN)
+		}
 	}
 
 	if service.LoadBalancers != nil {
@@ -333,6 +339,11 @@ func buildTaskDefinitionARN(taskDefinition string, meta interface{}) (string, er
 	return arn, nil
 }
 
+func buildIamRoleNameFromARN(arn string) string {
+	// arn:aws:iam::0123456789:role/EcsService
+	return strings.Split(arn, "/")[1]
+}
+
 func parseTaskDefinition(taskDefinition string) (string, string, error) {
 	matches := taskDefinitionRE.FindAllStringSubmatch(taskDefinition, 2)
 
diff --git a/builtin/providers/aws/resource_aws_ecs_service_test.go b/builtin/providers/aws/resource_aws_ecs_service_test.go
index f7776b210274..53412ec028f8 100644
--- a/builtin/providers/aws/resource_aws_ecs_service_test.go
+++ b/builtin/providers/aws/resource_aws_ecs_service_test.go
@@ -162,6 +162,22 @@ func TestAccAWSEcsServiceWithRenamedCluster(t *testing.T) {
 	})
 }
 
+func TestAccAWSEcsService_withIamRole(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSEcsServiceDestroy,
+		Steps: []resource.TestStep{
+			resource.TestStep{
+				Config: testAccAWSEcsService_withIamRole,
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSEcsServiceExists("aws_ecs_service.ghost"),
+				),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSEcsServiceDestroy(s *terraform.State) error {
 	conn := testAccProvider.Meta().(*AWSClient).ecsconn
 
@@ -253,6 +269,99 @@ resource "aws_ecs_service" "mongo" {
 }
 `
 
+var testAccAWSEcsService_withIamRole = `
+resource "aws_ecs_cluster" "main" {
+	name = "terraformecstest11"
+}
+
+resource "aws_ecs_task_definition" "ghost" {
+  family = "ghost_service"
+  container_definitions = <<DEFINITION
+[
+  {
+    "cpu": 128,
+    "essential": true,
+    "image": "ghost:latest",
+    "memory": 128,
+    "name": "ghost",
+    "portMappings": [
+      {
+        "containerPort": 2368,
+        "hostPort": 8080
+      }
+    ]
+  }
+]
+DEFINITION
+}
+
+resource "aws_iam_role" "ecs_service" {
+    name = "EcsService"
+    assume_role_policy = <<EOF
+{
+    "Version": "2008-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {"AWS": "*"},
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+EOF
+}
+
+resource "aws_iam_role_policy" "ecs_service" {
+    name = "EcsService"
+    role = "${aws_iam_role.ecs_service.name}"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "elasticloadbalancing:*",
+        "ec2:*",
+        "ecs:*"
+      ],
+      "Resource": [
+        "*"
+      ]
+    }
+  ]
+}
+EOF
+}
+
+resource "aws_elb" "main" {
+  name = "foobar-terraform-test"
+  availability_zones = ["us-west-2a"]
+
+  listener {
+    instance_port = 8080
+    instance_protocol = "http"
+    lb_port = 80
+    lb_protocol = "http"
+  }
+}
+
+resource "aws_ecs_service" "ghost" {
+  name = "ghost"
+  cluster = "${aws_ecs_cluster.main.id}"
+  task_definition = "${aws_ecs_task_definition.ghost.arn}"
+  desired_count = 1
+  iam_role = "${aws_iam_role.ecs_service.name}"
+
+  load_balancer {
+    elb_name = "${aws_elb.main.id}"
+    container_name = "ghost"
+    container_port = "2368"
+  }
+}
+`
+
 var testAccAWSEcsServiceWithFamilyAndRevision = `
 resource "aws_ecs_cluster" "default" {
 	name = "terraformecstest2"