problems with aws_iam_policy_attachment on subsequent applications (v0.6.13-dev)

[bmurphy1976]

Now that #5447 is fixed, I'm no longer seeing timeout errors when using aws_iam_policy_attachment, however, I am getting poor behavior when running terraform apply multiple times.

On first apply, everything appears to work as expected and the policy is attached to the role. However, on second and subsequent applications of apply I'm getting 404 errors:

aws_iam_policy_attachment.logcluster01-boot-BootDefault: Modifying...
  roles.#:          "6" => "1"
  roles.2330274987: "cs-testing-boot" => ""
  roles.3234134324: "logcluster01-boot" => "logcluster01-boot"
  roles.421482281:  "jenkinscluster02-boot" => ""
  roles.558085875:  "sandbox-boot" => ""
  roles.672936668:  "appcluster03-boot" => ""
  roles.706674977:  "etcdcluster01-boot" => ""
aws_iam_policy_attachment.sandbox-boot-BootDefault: Modifying...
  roles.#:          "6" => "1"
  roles.2330274987: "cs-testing-boot" => ""
  roles.3234134324: "logcluster01-boot" => ""
  roles.421482281:  "jenkinscluster02-boot" => ""
  roles.558085875:  "sandbox-boot" => "sandbox-boot"
  roles.672936668:  "appcluster03-boot" => ""
  roles.706674977:  "etcdcluster01-boot" => ""

results in errors such as:

* aws_iam_policy_attachment.logcluster01-boot-BootDefault: [WARN] Error updating user, role, or group list from IAM Policy Attachment logcluster01-boot-BootDefault:
– NoSuchEntity: Policy arn:aws:iam::SNIP:policy/BootDefault was not found.
    status code: 404, request id: 9fc3a67f-eb18-11e5-b078-db0075656f6a
* aws_iam_policy_attachment.sandbox-boot-BootDefault: [WARN] Error updating user, role, or group list from IAM Policy Attachment sandbox-boot-BootDefault:
– NoSuchEntity: Policy arn:aws:iam::SNIP:policy/BootDefault was not found.
    status code: 404, request id: 9fe251bb-eb18-11e5-8dde-d72429bbcd13

I suspect this has something to do with us attaching a single policy to multiple roles. Example policy definition here:

resource "aws_iam_policy_attachment" "logcluster01-boot-BootDefault" {
    name = "logcluster01-boot-BootDefault"
    policy_arn = "arn:aws:iam::SNIP:policy/BootDefault"
    roles = ["${aws_iam_role.logcluster01-boot.name}"]
}

I'm currently using HEAD as of 03/15/16:

$ terraform version
Terraform v0.6.13-dev (a1f77891611f47ad0c561d16a67007f4419a2358)

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.