CODEWITHSUNDEEP
terraformamazon-iamamazon-ecr
Verb
Verb

Reputation: 31

How to resolve json strings must not have leading spaces in terraform for AWS ecr IAM role

I saw a lot of topic opened for this kind of issue, but impossible to resolve this.

I'm trying to create AWS IAM role with attachments policy but I have always this issue :

Error: Error creating IAM Role test-role: MalformedPolicyDocument: JSON strings must not have leading spaces

I am fully aligned with the documentation :

Role : https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role

Policy attachment: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment

Please find my configuration

resource "aws_iam_instance_profile" "test-role-profile" {
  name = "test-role-profile"
  role = aws_iam_role.test-role.name
}

resource "aws_iam_role" "test-role" {
  name               = "test-role"
  assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Principal": {
          "Service": "ecr.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  EOF
}

resource "aws_iam_policy" "test-role-policy" {
  name        = "test-role-policy"
  description = "Test role policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
          "ecr:CreateRepository",
          "ecr:DescribeImages",
          "ecr:DescribeRegistry",
          "ecr:DescribeRepositories",
          "ecr:GetAuthorizationToken",
          "ecr:GetLifecyclePolicy",
          "ecr:GetLifecyclePolicyPreview",
          "ecr:GetRegistryPolicy",
          "ecr:GetRepositoryPolicy",
          "ecr:ListImages",
          "ecr:ListTagsForResource",
          "ecr:PutLifecyclePolicy",
          "ecr:PutRegistryPolicy",
          "ecr:SetRepositoryPolicy",
          "ecr:StartLifecyclePolicyPreview",
          "ecr:PutImage"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "test-role-attach" {
  role       = aws_iam_role.test-role.name
  policy_arn = aws_iam_policy.test-role-policy.arn
}

Version : Terraform v0.12.31

Anyone have an idea ?

Thks

Upvotes: 3

Views: 7843

Answers (1)

Mark B
Mark B

Reputation: 201088

You have some space before the first { character in the JSON string here:

resource "aws_iam_role" "test-role" {
  name               = "test-role"
  assume_role_policy = <<EOF
  {

It should look like this instead:

resource "aws_iam_role" "test-role" {
  name               = "test-role"
  assume_role_policy = <<EOF
{

I personally recommend either switching to the jsonencode() method of building JSON strings, which you can see examples of in your first link, or using aws_iam_policy_document to construct your IAM policies.

Upvotes: 7

Related Questions