Comments (7)
This comment was originally opened by @mroark1m as hashicorp/terraform#3517 (comment). It was migrated here as part of the provider split. The original comment is below.
I can confirm this issue, seeing the same thing.
from terraform-provider-aws.
This comment was originally opened by @mattpminer as hashicorp/terraform#3517 (comment). It was migrated here as part of the provider split. The original comment is below.
I can confirm as well.
from terraform-provider-aws.
This comment was originally opened by @jgross206 as hashicorp/terraform#3517 (comment). It was migrated here as part of the provider split. The original comment is below.
In fact, this issue is even worse. If a "terraform apply" of a modified AWS policy fails
(e.g. with
- aws_iam_policy.datadog: Error updating IAM policy [REDACTED]: MalformedPolicyDocument: Syntax errors in policy.
status code: 400, request id: [REDACTED]
)
Then subsequent "terraform plan" will say "No changes. Infrastructure is up-to-date." even though the infrastructure is decidedly not up-to-date.
from terraform-provider-aws.
This comment was originally opened by @Ehekatl as hashicorp/terraform#3517 (comment). It was migrated here as part of the provider split. The original comment is below.
confirm this problem as well
I have two s3 policy and one never change, but another one change every time as mentioned in #4948
how could it be...
from terraform-provider-aws.
I no longer see this for aws_iam_policy
behavior in the latest version of the provider.
I used this:
resource "aws_iam_policy" "policy" {
name = "test_policy"
path = "/"
description = "My test policy"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"ec2:Describe*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
EOF
}
Went into Console and changed "Allow" to "Deny", then did a terraform plan
. Here is my output:
~ aws_iam_policy.policy
policy: "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:Describe*\"\n ],\n \"Effect\": \"Deny\",\n \"Resource\": \"*\"\n }\n ]\n}" => "{\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Action\": [\n \"ec2:Describe*\"\n ],\n \"Effect\": \"Allow\",\n \"Resource\": \"*\"\n }\n ]\n}\n"
It wants to change "Deny" back to "Allow". And just to make sure there isn't any diffing problem here, I change my tf conf to say "Deny" instead of "Allow" and the terraform plan
comes back clean.
If I'm not mistaken, I believe it was fixed by @tomwilkie when they implemented the aws_iam_policy
import functionality here: hashicorp/terraform#9398 (comment). In that PR, the code starts taking the policy version into account and reading the policy back from AWS, which is the reason I think the diff wasn't getting picked up originally.
I believe this also addresses @jgross206 because I can't seem to repro it.
As for @Ehekatl's comment, if it still exists, then it should be reported in a different issue, since it doesn't use the same terraform resource.
from terraform-provider-aws.
Hi everyone,
@artburkart is right - I just verified this issue doesn't exist anymore (i.e. was fixed) in the latest provider version. It's very likely it was fixed a while back, so please try upgrading and let us know if the problem persists.
With that I'm closing this issue.
Thanks for reporting it.
from terraform-provider-aws.
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!
from terraform-provider-aws.
Related Issues (20)
- [Bug]: changing bootstrap configuration on existing EKS clusters should not trigger destroy/rebuild HOT 1
- [Bug]: aws_elasticsearch_domain dynamic "ebs_options" block not removed when appropriate HOT 1
- [Bug]: aws_iam_service_specific_credential password git credentials HOT 1
- [Bug]: aws_chatbot_slack_channel_configuration produced an unexpected new value: .configuration_name was X, but now Y HOT 1
- [Bug]: New Association for route table rtb-******* conflicts with an existing association HOT 1
- [Bug]: │ "vpcAttachmentOptions" is a required parameter for AWS DocumentDB source error using aws_osis_pipeline resource HOT 2
- [Enhancement]: r/aws_s3_object: Support conditional writes with `if_none_match` argument HOT 1
- [Bug]: error configuring Terraform AWS Provider: no valid credential sources for Terraform AWS Provider found HOT 4
- [Enhancement]: aws_inspector2_member_association to support multiple account_ids HOT 3
- [Bug]: aws_eks_cluster: adding `access_config` block triggers cluster recreate in absense of `bootstrap_cluster_creator_admin_permissions` HOT 2
- [Bug]: DynamoDB Global Tables v2, Unexpected Replica Deletion HOT 3
- [Enhancement]: aws_appflow_connector_profile - Support for usePrivateLinkForMetadataAndAuthorization HOT 1
- [Enhancement]: Add AuthenticationConfiguration in AWS Glue connection HOT 1
- [New Resource]: aws_dynamodb_table_backup HOT 1
- [New Resource]: aws_cloudwatch_retention_period HOT 1
- [Bug]: Provider does not handle C2S region failures for multiple resource types HOT 2
- [Bug]: Failures in C2S regions when creating Step Functions due to UnsupportedOperation calling ListStateMachineVersions HOT 2
- [Bug]: r/aws_neptune_cluster and r/aws_neptune_cluster_instance use incorrect default parameter group families HOT 1
- [Bug]: reading Lake Formation permissions: listing permissions: operation error LakeFormation: ListPermissions HOT 1
- [Bug]: `aws_autoscaling_schedule` start_time is not recalculated when modifying the resource HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-provider-aws.