CODEWITHSUNDEEP
amazon-web-servicesterraform
Robin Salih
Robin Salih

Reputation: 547

MalformedPolicyDocument error when creating policy via terraform

I am getting the following error when running terraform:

* aws_iam_role_policy.rds_policy: Error putting IAM role policy my-rds-policy: MalformedPolicyDocument: The policy failed legacy parsing

Here is my definition of the resource:

resource "aws_iam_role_policy" "rds_policy" {
  name = "my-rds-policy"
  role = "${aws_iam_role.rds_role.id}"
  policy = <<EOF
  {
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetBucketLocation"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetObjectMetaData",
              "s3:GetObject",
              "s3:PutObject",
              "s3:ListMultipartUploadParts",
              "s3:AbortMultipartUpload"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket/backups/*"
          ]
      }
  ]
}
EOF
}

The JSON policy doc is well formed, and I can't see anything obvious.

Upvotes: 21

Views: 42088

Answers (2)

ydaetskcoR
ydaetskcoR

Reputation: 56877

You need to make sure that you don't have any indentation at the start of your EOF heredoc because your JSON policy should not start with an indented brace.

So you should be fine with this small change:

resource "aws_iam_role_policy" "rds_policy" {
  name = "my-rds-policy"
  role = "${aws_iam_role.rds_role.id}"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Action": [
              "s3:ListBucket",
              "s3:GetBucketLocation"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket"
          ]
      },
      {
          "Effect": "Allow",
          "Action": [
              "s3:GetObjectMetaData",
              "s3:GetObject",
              "s3:PutObject",
              "s3:ListMultipartUploadParts",
              "s3:AbortMultipartUpload"
          ],
          "Resource": [
              "arn:aws:s3:::my-bucket/backups/*"
          ]
      }
  ]
}
EOF
}

Upvotes: 23

Martin Verner
Martin Verner

Reputation: 742

Alternatively change <<EOF to <<-EOF to allow indentation. It will then remove the number of indentation matching the line with fewest indentations at apply.

Upvotes: 8

Related Questions