Terraform-provider-aws: API Gateway Resource Policy JSON

[danieladams456]

Terraform Version

Terraform v0.11.7

• provider.aws v1.16.0

Affected Resource(s)

• aws_api_gateway_rest_api

Terraform Configuration Files

resource "aws_api_gateway_rest_api" "api" {
  name        = "${var.api_gateway_name}"
  description = "${var.api_gateway_description}"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "*",
      "Condition": {
          "IpAddress": {
              "aws:SourceIp": "123.123.123.123/19"
          }
      }
    }
  ]
}
EOF
}

Debug Output

https://gist.github.com/danieladams456/5a52c3cfaf3ce72ff788c030f93bb723

Expected Behavior

Apply sets API Gateway resource policy

Actual Behavior

Plan or apply gives error: aws_api_gateway_rest_api.api: aws_api_gateway_rest_api.api: error unescaping policy: invalid syntax

Steps to Reproduce

1. terraform apply

Important Factoids

Adding it to an existing project fails, but creating a new project with the same policy and the single resource succeeds. Still digging into that why.

References

Are there any other GitHub issues (open or closed) or Pull Requests that should be linked here? For example:

• GH-4211

[danieladams456]

The seemingly relevant line in the debug output for the working project and the non-working project are the same:

"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"*\\\",\\\"Condition\\\":{\\\"IpAddress\\\":{\\\"aws:SourceIp\\\":\\\"123.123.123.123\\/19\\\"}}}]}"

"{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\",\\\"Action\\\":\\\"execute-api:Invoke\\\",\\\"Resource\\\":\\\"*\\\",\\\"Condition\\\":{\\\"IpAddress\\\":{\\\"aws:SourceIp\\\":\\\"123.123.123.123\\/19\\\"}}}]}"

I have updated the debug gist to include both. Thanks!

[ouroboros8]

I've done a bit of digging on this and it looks like strconv.Unquote is not happy if you pass it a string with escaped forward slashes, and the policy string AWS returns escapes the forward slash in the CIDR block.

[danieladams456]

Thanks @ouroboros8 - looks spot on!

[azizbodal]

Yup, having the same issue. Cannot get the policy to work. Looking forward to a fix.

[asrivastava2017]

Same issue here as well , is there a specific format for this. ?

[bflad]

Thanks to @ouroboros8 a fix for escape character handling (#4606) has been merged and will release with v1.20.0 of the AWS provider later this week.

[bflad]

This has been released in version 1.20.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ricoms]

I obtained a similar issue, my terraform:

resource "aws_api_gateway_rest_api" "api" {
  name = "${var.project_name}"

  endpoint_configuration {
    types = ["${var.endpoint_type}"]
  }

  tags = {
    env     = "${var.status}"
    system  = "${var.project_name}"
    type    = "service"
  }

  policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        }
    ]
}
EOF
}

Error message: Error: BadRequestException: Invalid policy document. Please check the policy syntax and ensure that Principals are valid.

extra information

provider "aws" {
  region  = "${var.region}"
  version = "~> 2.42"
}

terraform {
  required_version = ">= 0.12"
}

[hashibot[bot]]

I'm going to lock this issue because it has been closed for _30 days_ ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!