# Confusion about dependencies and terraform plan

**URL:** <https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464>\
**Category:** Terraform\
**Created:** [December 7, 2019, 10:09pm UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464 "2019-12-07T22:09:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeffdyke](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffdyke/32/3528_2.png) [@jeffdyke](https://discuss.hashicorp.com/u/jeffdyke)\
**Post date:** [December 7, 2019, 10:09pm UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464/1 "2019-12-07T22:09:01Z")

</div>

Pretty new to Terraform. I am in the process of migrating an existing 3 VPC infrastructure into terraform. Items like `aws_iam_role` are reused in some VPCs, so i created them in a`global` module and import it in the root module and child modules that require it.

I have the instance imported with  
`terraform import module.instances.aws_instance.devjump01 i-XXXXXXXXXXX`  
Then i import the `aws_iam_role` with  
`terraform import module.global.aws_iam_role.devfoo devfoo`

There is also an output value that contains:

> Blockquote  
> output “iam\_role\_devfoo” {  
> value = aws\_iam\_role.devfoo.name  
> }

if i run `terraform plan -target=module.global.aws_iam_role.devfoo`  
It shows no changes  
if i run `terraform plan -target=module.instances.aws_instance.devjump01`  
it shows module.instances.module.global.aws\_iam\_role.devfoo will be created

I thought that by adding `iam_instance_profile = module.global.iam_role_devfoo`, in instances.tf, against the appropriate instance it would both adhere to the dependency, which it does, but also not create it b/c it exists at that path.

It doesn’t seem to be an issue with using `-target` on `terraform plan` as it shows up in a global plan as well.

I’m happy to provide more details as i’m working my way though understanding everything, which has been pretty simple until this. I assume i’m doing something wrong.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![bentterp](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bentterp/32/3450_2.png) [@bentterp](https://discuss.hashicorp.com/u/bentterp)\
**Post date:** [December 8, 2019, 8:35am UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464/3 "2019-12-08T08:35:36Z")

</div>

IAM roles are defined at the subscrition level, not at the VPC level.

My suggestion is to have a separate configuration for the global resources like IAM users, roles and group

And then use terraform\_remote\_state in the VPC configuration [https://www.terraform.io/docs/providers/terraform/d/remote\_state.html](https://www.terraform.io/docs/providers/terraform/d/remote_state.html)

You **can** do this using modules as well but in my opinion you end up spending too much time on the module interfaces and too little on the resources.

---

<div class="post-metadata">

**Author:** ![jeffdyke](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffdyke/32/3528_2.png) [@jeffdyke](https://discuss.hashicorp.com/u/jeffdyke)\
**Post date:** [December 8, 2019, 2:27pm UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464/4 "2019-12-08T14:27:41Z")

</div>

Thanks for the input. That is actually how i have it laid out,

- vpc
  - dev
    - instances.tf
    - network.tf
    - etc

- global
  - aws\_iam\_roles.tf
  - etc

from `instances.tf` I’m trying to get the relationship inferred so its treated as a dependency, which seems to work well, but when i run a plan it wants to create them twice.

I had deleted a post from last night b/c my initial issue had been fixed in an upgrade from .12.8 to .12.17…and then I got distracted.

with the `aws_iam_instance` having a variable that ties them together as such:  
`iam_instance_profile = module.global.iam_role_devfoo`

I have more research to do this morning, but i wanted to reply b/c i had gotten a bit further, but didn’t update my question.

I had created all of the resources with the terraforming gem and then reorganized them into **vpc** (3 in total) resources and **global** resources.

I also intend to use the remote state, but right now I’m just working locally.

Ultimately this may be a new question. Given that they want to be created twice, i may have a circular dependency, or similar issue.

Thanks again, i was going to delete the question, but since it was liked by someone, i didn’t want to pursue that. I’ll update when i figure out what i’ve done.

---

<div class="post-metadata">

**Author:** ![jeffdyke](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffdyke/32/3528_2.png) [@jeffdyke](https://discuss.hashicorp.com/u/jeffdyke)\
**Post date:** [December 8, 2019, 2:44pm UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464/5 "2019-12-08T14:44:13Z")

</div>

EDIT: I did have a circular dependency. This is now working nearly as expected and i’m sure the nearly is more work i have to do. Considering this closed for now.

---

<div class="post-metadata">

**Author:** ![jeffdyke](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jeffdyke/32/3528_2.png) [@jeffdyke](https://discuss.hashicorp.com/u/jeffdyke)\
**Post date:** [December 11, 2019, 10:44pm UTC](https://discuss.hashicorp.com/t/confusion-about-dependencies-and-terraform-plan/4464/6 "2019-12-11T22:44:07Z")

</div>

Just wanted to say thanks again, i did end up moving to using remote\_state and unlinked what was both a data module and execution target, when using as a data module, i use `terraform_remote_state`. Really would like to get the other way to work, but your thought was exactly what i needed.