plan output shows aws_iam_policy_document statement condition taking only the last item in a list

[chaosun-cs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v0.12.31
registry.terraform.io/hashicorp/aws v3.67.0

Affected Resource(s)

aws_iam_policy_document

Terraform Configuration Files

providers.tf

provider "aws" {
  region  = var.region
  version = ">= 2.47.0"
}

main.tf

data "aws_iam_policy_document" "irsa_assume_role_policy" {
  count = var.create_role ? 1 : 0
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    effect  = "Allow"

    dynamic "condition" {
      for_each = var.oidc_fully_qualified_subjects
      content {
        test     = "StringEquals"
        variable = "${var.oidc_provider_url}:sub"
        values   = [condition.value]
      }
    }

    dynamic "condition" {
      for_each = var.oidc_wildcard_subjects
      content {
        test     = "StringLike"
        variable = "${var.oidc_provider_url}:sub"
        values   = [condition.value]
      }
    }

    dynamic "condition" {
      for_each = var.service_accounts
      content {
        test     = "StringEquals"
        variable = "${var.oidc_provider_url}:sub"
        values   = [format("system:serviceaccount:%s:%s", condition.value.namespace, condition.value.name)]
      }
    }

    principals {

      identifiers = [
        "arn:aws:iam::${local.aws_account_id}:oidc-provider/${var.oidc_provider_url}"
      ]

      type = "Federated"
    }
  }
}

terragrunt.hcl

inputs = {
  entry = {
    service_accounts = [{
        namespace = "test"
        name      = "sa1"
      },
      {
        namespace = "test"
        name      = "sa2"
    }],
  }
}

Debug Output

  ~ resource "aws_iam_role" "this" {
        arn                   = "SOME ARN"
      ~ assume_role_policy    = jsonencode(
          ~ {
              ~ Statement = [
                  ~ {
                        Action    = "sts:AssumeRoleWithWebIdentity"
                      ~ Condition = {
                          ~ StringEquals = {
                              ~ oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
                                  - "system:serviceaccount:test:sa1",
                                  - "system:serviceaccount:test:sa2",
                                ] -> "system:serviceaccount:test:sa2"
                            }
                        }
                        Effect    = "Allow"
                        Principal = {
                            Federated = "SOME ARN"
                        }
                        Sid       = ""
                    },
                ]
                Version   = "2012-10-17"
            }
        )
        ... ...
    }

Panic Output

Expected Behavior

There should be no change to the condition

                      Condition = {
                          StringEquals = {
                              oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
                                  "system:serviceaccount:test:sa1",
                                  "system:serviceaccount:test:sa2",
                                ]
                            }
                        }

Actual Behavior

This change is shown

                      ~ Condition = {
                          ~ StringEquals = {
                              ~ oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
                                  - "system:serviceaccount:test:sa1",
                                  - "system:serviceaccount:test:sa2",
                                ] -> "system:serviceaccount:test:sa2"
                            }
                        }

Steps to Reproduce

1. terragrunt plan

Important Factoids

References

• #0000

[chaosun-cs]

Might be related to #19533

[phang98]

My view the dynamic block usage in this context is invalid. What you want to achieve is single condition with multiple values, but if you base on service account variable it become multiple conditions with single value. Therefore it always taken the last value as a valid condition.
What is generated by your code,

Condition = {
    StringEquals = {
        oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
            "system:serviceaccount:test:sa1",
        ]
    }
}

Condition = {
    StringEquals = {
        oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
            "system:serviceaccount:test:sa2",
        ]
    }
}

You should try,

locals {
    value_list = flatten([
        for account in var.service_accounts : format("system:serviceaccount:%s:%s", account.namespace, account.name)
    ])
}

condition {
    test     = "StringEquals"
    variable = "${var.oidc_provider_url}:sub"
    values   = local.valuelist
}

+ policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringEquals = {
                              + oidc.eks.us-east-1.amazonaws.com/id/******:sub = [
                                  + "system:serviceaccount:test:sa1",
                                  + "system:serviceaccount:test:sa2",
                                ]
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::****:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/******"
                        }
                      + Sid       = ""
                    },
                ]
              + Version   = "2012-10-17"
            }
        )

[nomeelnoj]

The dynamic is ideal here as it allows the IAM role module to be more generic, supporting both an IRSA role as well as others, that do not have any condition blocks. Creating a module JUST for IRSA role is an alternative, but requires unneeded overhead.

This is something that was working as expected prior to 3.67.

[github-actions]

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.