Terraform-provider-aws: Bug: leading whitespace causes aws_iam_policy to incorrectly report valid JSON policies as invalid

[MikeSchuette]

Terraform Version

0.10.7, 0.9.11

Affected Resource(s)

• aws_iam_role
• aws_iam_policy

Terraform Configuration Files

resource "aws_iam_policy" "nodes_sqs_policy" {
    name        = "nodes_sqs_policy"
    description = "nodes SQS"
    policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "sqs:GetQueueAttributes"
          ],
          "Resource": [
            "arn:aws:sqs:us-east-1:123123123:myapp-dev-us-east-1*"
          ]
        }
      ]
    }
EOF
}

Expected Behavior

The policy was applied

Actual Behavior

1 error(s) occurred:

* aws_iam_policy.nodes_sqs_policy: "policy" contains an invalid JSON policy

Important Factoids

According to RFC 4627, "Insignificant whitespace is allowed before or after any of the six structural characters."

Removing the whitespace before the first character in the policy allows it to be applied:

data "template_file" "nodes_iam_sqs" {
    name        = "nodes_sqs_policy"
    description = "nodes SQS"
    policy = <<EOF
{
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "sqs:GetQueueAttributes"
          ],
          "Resource": [
            "arn:aws:sqs:us-east-1:123123123:myapp-dev-us-east-1*"
          ]
        }
      ]
    }
EOF
}

References

Terraform #11906 is where the JSON validation was applied.

[xocasdashdash]

Adding this here as docs but this can cause bugs on resources that depend on this policy and the warning is extremely disconcerting.

The example would be if you have an aws_iam_role_policy_attachment depend on your policy it will tell you that the policy does not exist.

[nodesocket]

I came across this today as well. This is a bug right?

    policy = <<CONFIG
    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                    "s3:GetObject"
                ],
                "Resource": [
                    "arn:aws:s3:::our-org-secrets",
                    "arn:aws:s3:::our-org-secrets/*"
                ]
            }
        ]
    }
    CONFIG

"policy" contains an invalid JSON policy

[mplanchard]

Also affects terraform 0.11.4, aws provider 1.13.0

[lakshmigk01]

+1 I encountered this as well

[woodcockjosh]

trim

[larroy]

+1

[nwipfli]

+1 Same issue for me.

[whatisaphone]

[MikeSchuette]

I finally had a minute to write https://github.com/terraform-providers/terraform-provider-aws/pull/5887 but I don't currently have an environment I can run acceptance tests in. If someone can pull my branch, run make testacc TEST=./aws TESTARGS='-run=TestAccAWSLaunchTemplate_', and post results in the PR thread, that might help get this merged.

[MikeSchuette]

I found a donor account, test results are added.

[mgasner]

👍

[goetzc]

As a workaround on using the ugly JSON inline Heredoc, the aws_iam_policy_document data source works great, HCL to JSON transformer.