aws_iam_policy_document data source diff with single element arrays

[blackjid]

Terraform Version

Terraform v0.7.0-rc2 (46a0709)

Affected Resource(s)

• aws_iam_policy_document

Terraform Configuration Files

data "aws_iam_policy_document" "key_store_kms" {
  statement {
    actions = [
      "kms:*"
    ]
    resources = [
      "*"
    ]
    effect = "Allow"
    principals {
      type = "AWS"
      identifiers = ["arn:aws:iam::0958430598340:root"]
    }
  }
}

resource "aws_kms_key" "key_store" {
  description = "Protects secrets stored in S3"
  policy = "${data.aws_iam_policy_document.key_store_kms.json}"
}

Expected Behavior

The policy shouldn't be marked to be modified in the plan phase. All the arguments that received a [] with only one element, should be rendered as a string.

Actual Behavior

The policy is marked to be modified every time I run terraform plan and apply.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform plan
2. terraform apply
3. terraform plan

References

• GH-1234
  The is a mention about the problem but it's hidden in a merge PR.

  There needs to be some logic to ensure that array items like Actions get converted to strings instead of []strings if there is only one element (this was one of the things that was causing recurring diffs in unchanged policies). So those elements probably need to be interface{} and then handled accordingly.

[apparentlymart]

Hi @blackjid. Sorry for the troubles here.

As you noted, this is likely due to the fact that lots of AWS APIs will normalize IAM policies they return, which can cause them to appear differently than is rendered by this resource. It would be good to do an audit of various different AWS services that deal with IAM policies and see what normalizations are consistent and which are different.

I expect we can encode certain normalizations directly in this data source, like the one you mentioned of not using arrays with only one element. However, I suspect there will be cases where the exact normalization differs slightly from one AWS API to the next so certain resources may need to do some additional normalization work to adapt to these specifics.

[blackjid]

Thanks for the explanations @apparentlymart.

The tests I did were in the using the policy in the aws_kms_key resource. I've edited the issue adding that info

[dtolnay]

I have a fix in #7785.

[joshuaspence]

+1

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.