test if iam profile alread was destroyed by terraform

[thiagonache]

Summary

When terraform try to destroy an IAM role. It loops for every IAM Instance Profile attached and try to delete the attachment.

// Roles cannot be destroyed when attached to an existing Instance Profile
    resp, err := iamconn.ListInstanceProfilesForRole(&iam.ListInstanceProfilesForRoleInput{
        RoleName: aws.String(d.Id()),
    })
    if err != nil {
        return fmt.Errorf("Error listing Profiles for IAM Role (%s) when trying to delete: %s", d.Id(), err)
    }

    // Loop and remove this Role from any Profiles
    if len(resp.InstanceProfiles) > 0 {
        for _, i := range resp.InstanceProfiles {
            _, err := iamconn.RemoveRoleFromInstanceProfile(&iam.RemoveRoleFromInstanceProfileInput{
                InstanceProfileName: i.InstanceProfileName,
                RoleName:            aws.String(d.Id()),
            })
            if err != nil {
                return fmt.Errorf("Error deleting IAM Role %s: %s", d.Id(), err)
            }
        }
    }

But here, if you create IAM Instance Profile by terraform it will be deleted before and cause exception here.

Fix

I check if IAM Instance profile still exists before removing the attachment.

    // Loop and remove this Role from any Profiles
    if len(resp.InstanceProfiles) > 0 {
        for _, i := range resp.InstanceProfiles {
            // Test if profile was already deleted by terraform
            _, err := iamconn.GetInstanceProfile(&iam.GetInstanceProfileInput{
                InstanceProfileName: i.InstanceProfileName,
            })
            if err != nil {
                _, err := iamconn.RemoveRoleFromInstanceProfile(&iam.RemoveRoleFromInstanceProfileInput{
                    InstanceProfileName: i.InstanceProfileName,
                    RoleName:            aws.String(d.Id()),
                })
                if err != nil {
                    return fmt.Errorf("Error deleting IAM Role %s: %s", d.Id(), err)
                }
            }
        }
    }

Note

You can also fix it using depends_on. But I guess it's a bug. Please let me know what you guys think.

[thiagonache]

Moved to issue #6082 for evaluation

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.