CloudTrail resource creation failure when creating aws_iam_role and aws_iam_role_policy in single run

[hashibot]

This issue was originally opened by @tmclaugh as hashicorp/terraform#13631. It was migrated here as part of the provider split. The original body of the issue is below.

---

There appears to be an issue with creating cloudtrails when the iam role for cloudwatch logs
is created in the same run. Terraform says the resource creation has completed but when creating the CloudTrail an InvalidCloudWatchLogsRoleArnException error occurs. A subsequent run completes just fine. This leads me to believe that the issue is with the IAM role policy change not being propagated across AWS fast enough for Terraform.

Terraform Version

Terraform v0.9.3

Affected Resource(s)

Please list the resources as a list, for example:

• aws_cloudtrail
• aws_iam_role_policy
• aws_iam_role

Terraform Configuration Files

https://gist.github.com/0dd20ed6bc2a9dcd5c316c9d5193cdc2

Debug Output

https://gist.github.com/690acefc73b6509d89e53f389981cdd0

Expected Behavior

aws_cloudtrail is successful created

Actual Behavior

It appears that the role policy is not properly propagated by AWS before attempting to create the cloudtrail resource. A second run successfully creates wht aws_cloudtrail resource.

* aws_cloudtrail.ct: InvalidCloudWatchLogsRoleArnException: Access denied. Check the trust relationships for your role.
        status code: 400, request id: 4a209c1f-206b-11e7-bb0a-0d6cd06b0119

Steps to Reproduce

1. terraform apply

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!