Confusion about "aws_iam_role.managed_policy_arns" attribute

henninge · September 21, 2021, 10:06am

Hi!

I am upgrading the AWS provider and stumbled onto the fairly new attribute aws_iam_role.managed_polcy_arns The documentation for this attribute includes this statement:

If this attribute is not configured, Terraform will ignore policy attachments to this resource.

What does that mean? My code does not configure this attribute but has a aws_iam_role_policy_attachement resource which is incompatible with this attribute. Will it be ignored?

Background: Terraform wants to add the new attribute with the arn from the attachment to the state. In my view that would create an inconsistent state since it conflicts with my existing attachment.

I am not sure if this is a bug or if I am misreading the documentation.

anthony.foiani · February 5, 2022, 6:56am

Hello!

I also found the semantics / documentation of managed_policy_arns confusing, to the point where I flailed around a bit on one of the related feature requests:

github.com/hashicorp/terraform-provider-aws

Feature request: Exclusive policy attachment list for users, groups, and roles

opened 04:37PM - 02 May 18 UTC

jbscare

enhancement service/iam

### Terraform Version ``` +$ terraform -v Terraform v0.11.7 + provider.aws… v1.16.0 ``` ### Affected Resource(s) - aws_iam_user_policy_attachment - aws_iam_group_policy_attachment - aws_iam_role_policy_attachment ### Expected Behavior This is a feature request for either (a) an enhancement to aws_iam_user_policy_attachment, aws_iam_group_policy_attachment, and aws_iam_role_policy_attachment; or (b) to create a new trio of resources (perhaps aws_iam_user_policy_list, aws_iam_group_policy_list, and aws_iam_role_policy_list?), to allow for the specification of an exclusive list of policies that should be attached to a group or role, much like aws_iam_group_membership allows for the specification of an exclusive list of users who should be members of a group. If any policies are found attached to the group or role that aren't on the list, they should be removed. ### Actual Behavior There doesn't seem to be a way to accomplish this effect at this time. (You can get sort of a converse of this effect with aws_iam_policy_attachment, which specifies an exclusive list of roles and users and groups to which a policy is attached, but doesn't exclude other policies from being attached to a role, user, or group.) ### Use case We'd like to use Terraform to fully specify the policies that should be attached to a user or group or role, and if someone adds a policy outside of Terraform, for Terraform to detect and correct that.

Hopefully the discussion at the end (between @lorengordon and myself) helps dispel the confusion – and if you have suggestions for better phrasing (which would hopefully bypassed the confusion we both had on this attribute), I believe it would be welcome.