Passing list of strings to aws_iam_policy_document principals produces error.

[Jamie-BitFlight]

This is using the aws provider.

Terraform Version

Terraform v0.10.7

Terraform Configuration Files

locals {
  a = "arn:aws:iam::${module.accounts.account_ids["dds"]}:user"
  principal_users = [
  "${local.a}/xxxx",
  "${local.a}/yyyy",
  ]
 dds3_policies = [
 "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
 "arn:aws:iam::aws:policy/AWSSupportAccess",
 "arn:aws:iam::aws:policy/AmazonS3FullAccess",
 "arn:aws:iam::aws:policy/ReadOnlyAccess"
   ]
}
######
resource "aws_iam_role" "ddslevel3role" {
  name = "DDS_Level3"
  assume_role_policy = "${data.aws_iam_policy_document.ddslevel3role.json}"
}

resource "aws_iam_role_policy_attachment" "ddslevel3role" {
    count = "${length(local.dds3_policies)}"
    role       = "${aws_iam_role.ddslevel3role.name}"
    policy_arn = "${local.dds3_policies[count.index]}"
}

data "aws_iam_policy_document" "ddslevel3role" {
  policy_id = "DDSLevel3RolePolicy"
  statement {
    actions = ["sts:AssumeRole"]
    effect = "Allow"
    principals = ["${local.principal_users}"]
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values = ["true"]
    }
    sid = "ddslevel3role"
  }
}

Debug Output

data.aws_iam_policy_document.ddslevel3role - *terraform.NodeValidatableResourceInstance
2017/10/20 11:23:39 [DEBUG] Resource state not found for "data.aws_iam_policy_document.ddslevel2role": data.aws_iam_policy_document.ddslevel2role
2017/10/20 11:23:39 [TRACE] root: eval: *terraform.EvalInterpolate
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "data.aws_iam_policy_document.ddslevel2role" references: []
2017/10/20 11:23:39 [ERROR] root: eval: *terraform.EvalValidateResource, err: Warnings: []. Errors: [statement.0.principals.0: expected object, got string]
2017/10/20 11:23:39 [ERROR] root: eval: *terraform.EvalSequence, err: Warnings: []. Errors: [statement.0.principals.0: expected object, got string]
2017/10/20 11:23:39 [TRACE] [walkValidate] Exiting eval tree: data.aws_iam_policy_document.ddslevel2role
2017/10/20 11:23:39 [ERROR] root: eval: *terraform.EvalValidateResource, err: Warnings: []. Errors: [statement.0.principals.0: expected object, got string statement.0.principals.1: expected object, got string statement.0.principals.2: expected object, got string statement.0.principals.3: expected object, got string statement.0.principals.4: expected object, got string statement.0.principals.5: expected object, got string statement.0.principals.6: expected object, got string statement.0.principals.7: expected object, got string]
2017/10/20 11:23:39 [ERROR] root: eval: *terraform.EvalSequence, err: Warnings: []. Errors: [statement.0.principals.0: expected object, got string statement.0.principals.1: expected object, got string statement.0.principals.2: expected object, got string statement.0.principals.3: expected object, got string statement.0.principals.4: expected object, got string statement.0.principals.5: expected object, got string statement.0.principals.6: expected object, got string statement.0.principals.7: expected object, got string]
2017/10/20 11:23:39 [TRACE] [walkValidate] Exiting eval tree: data.aws_iam_policy_document.ddslevel3role
2017/10/20 11:23:39 [TRACE] dag/walk: walking "aws_iam_role.ddslevel2role"
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role.ddslevel2role": aws_iam_role.ddslevel2role
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role.ddslevel3role": aws_iam_role.ddslevel3role
2017/10/20 11:23:39 [TRACE] Graph after step *terraform.AttachStateTransformer:

aws_iam_role.ddslevel2role - *terraform.NodeValidatableResourceInstance
2017/10/20 11:23:39 [TRACE] Graph after step *terraform.AttachStateTransformer:

aws_iam_role.ddslevel3role - *terraform.NodeValidatableResourceInstance
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role_policy_attachment.ddslevel2role[0]": aws_iam_role_policy_attachment.ddslevel2role[0]
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role_policy_attachment.ddslevel2role[1]": aws_iam_role_policy_attachment.ddslevel2role[1]
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel2role[0]" references: []
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel2role[1]" references: []
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role_policy_attachment.ddslevel3role[2]": aws_iam_role_policy_attachment.ddslevel3role[2]
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role_policy_attachment.ddslevel3role[3]": aws_iam_role_policy_attachment.ddslevel3role[3]
2017/10/20 11:23:39 [DEBUG] Resource state not found for "aws_iam_role_policy_attachment.ddslevel3role[0]": aws_iam_role_policy_attachment.ddslevel3role[0]
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel3role[1]" references: []
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel3role[2]" references: []
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel3role[3]" references: []
2017/10/20 11:23:39 [TRACE] root: eval: *terraform.EvalValidateResource
2017/10/20 11:23:39 [DEBUG] ReferenceTransformer: "aws_iam_role_policy_attachment.ddslevel3role[0]" references: []
2017/10/20 11:23:39 [DEBUG] plugin: waiting for all plugin processes to complete...
9 error(s) occurred:

• data.aws_iam_policy_document.ddslevel2role: statement.0.principals.0: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.0: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.1: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.2: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.3: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.4: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.5: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.6: expected object, got string
• data.aws_iam_policy_document.ddslevel3role: statement.0.principals.7: expected object, got string

Expected Behavior

terraform plan
Finishes normally.

Actual Behavior

Terraform fails to handle list of strings correctly when a variable is used.

Steps to Reproduce

Please list the full steps required to reproduce the issue, for example:

1. terraform init
2. terraform plan

References

• AWS App Mesh retry policies #10075

[Jamie-BitFlight]

turns out I was addressing principals incorrectly

it should have been

data "aws_iam_policy_document" "ddslevel3role" {
  policy_id = "DDSLevel3RolePolicy"
  statement {
    actions = ["sts:AssumeRole"]
    effect = "Allow"
    principals = {
      type = "AWS"
      identifiers = ["${local.principal_users}"]
    }
    condition {
      test     = "Bool"
      variable = "aws:MultiFactorAuthPresent"
      values = ["true"]
    }
    sid = "ddslevel3role"
  }
}

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!