Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWS ECR Policy - need to run terraform apply twice #545

Closed
hashibot opened this issue Jun 13, 2017 · 5 comments · Fixed by #14193
Closed

AWS ECR Policy - need to run terraform apply twice #545

hashibot opened this issue Jun 13, 2017 · 5 comments · Fixed by #14193
Labels
bug Addresses a defect in current functionality. service/ecr Issues and PRs that pertain to the ecr service. stale Old or inactive issues managed by automation, if no further action taken these will get closed.
Milestone

Comments

@hashibot
Copy link

This issue was originally opened by @vikas027 as hashicorp/terraform#12108. It was migrated here as part of the provider split. The original body of the issue is below.


Terraform Version

~$ terraform -v
Terraform v0.8.7

Affected Resource(s)

  • aws_ecr_repository
  • aws_ecr_repository_policy

Terraform Configuration Files

resource "aws_iam_role_policy" "ecr_admin_policy" {
    name = "ecr_admin_policy"
    role = "${aws_iam_role.ecr_admin_role.id}"
    policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ecr:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role" "ecr_admin_role" {
  name = "${var.iam_role}"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_ecr_repository" "images" {
  depends_on = [ "aws_iam_role_policy.ecr_admin_policy", "aws_iam_role.ecr_admin_role" ]
  count = "${length(var.list_of_images)}",
  name  = "${element(var.list_of_images, count.index)}"
}

resource "aws_ecr_repository_policy" "repo_policy" {
  count = "${length(var.list_of_images)}"
  repository = "${element(aws_ecr_repository.images.*.id, count.index)}"
  policy = <<POLICY
{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "repo_policy",
            "Effect": "Allow",
            "Principal": {
              "AWS": [
                "arn:aws:iam::11111111111111:root",
                "arn:aws:iam::11111111111111:role/ecr_admin"
              ]
            },
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:PutImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:DescribeRepositories",
                "ecr:GetRepositoryPolicy",
                "ecr:ListImages",
                "ecr:DeleteRepository",
                "ecr:BatchDeleteImage",
                "ecr:SetRepositoryPolicy",
                "ecr:DeleteRepositoryPolicy"
            ]
        }
    ]
}
POLICY
}

Debug Output

First Run terraform apply (fails)
Second Run terraform apply (succeeds)

Expected Behavior

terraform apply should not complain about the policy.

Actual Behavior

terraform apply complains about invalid policy on the first run. And then creates ECR policy in the second run.
I have tried to set resource dependencies using depends_on in vain, behavior is same without this parameter.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

  1. terraform apply (throws an error)
  2. terraform apply (run okay this time)

References

Few other similar issues where terraform does not wait for enough time or AWS reports that the resource creation is complete (a false positive)

@hashibot hashibot added the bug Addresses a defect in current functionality. label Jun 13, 2017
@bflad bflad added the service/ecr Issues and PRs that pertain to the ecr service. label Jan 18, 2018
rubberduck203 added a commit to UrbanOS-Examples/common that referenced this issue Jul 12, 2018
This works *most* of the time, but there's a bug in terraform that causes
the ECR policy to fail sometimes.

hashicorp/terraform-provider-aws#545

co-authored-by: Paul Linville <[email protected]>
rubberduck203 added a commit to UrbanOS-Examples/common that referenced this issue Jul 12, 2018
This works *most* of the time, but there's a bug in terraform that causes
the ECR policy to fail sometimes.

hashicorp/terraform-provider-aws#545

co-authored-by: Paul Linville <[email protected]>
rubberduck203 added a commit to UrbanOS-Examples/common that referenced this issue Jul 13, 2018
This works *most* of the time, but there's a bug in terraform that causes
the ECR policy to fail sometimes.

hashicorp/terraform-provider-aws#545

co-authored-by: Paul Linville <[email protected]>
@jasonmc86
Copy link

The same also happens for a aws_cloudformation_stack depending on aws_iam_role that assume's a role (in this case cloudformation.amazonaws.com)

Error:

Creating CloudFormation stack failed: ValidationError: Role arn:aws:iam::* is invalid or cannot be assumed
  • on a re run it works fine.
Terraform v0.11.7
+ provider.aws v1.29.0

wizardfiction pushed a commit to UrbanOS-Examples/scos-alm that referenced this issue Jan 10, 2019
This works *most* of the time, but there's a bug in terraform that causes
the ECR policy to fail sometimes.

hashicorp/terraform-provider-aws#545

co-authored-by: Paul Linville <[email protected]>
@knservis
Copy link

@jasonmc86 Do you have a workaround until this gets fixed?

@github-actions
Copy link

Marking this issue as stale due to inactivity. This helps our maintainers find and focus on the active issues. If this issue receives no comments in the next 30 days it will automatically be closed. Maintainers can also remove the stale label.

If this issue was automatically closed and you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thank you!

@github-actions github-actions bot added the stale Old or inactive issues managed by automation, if no further action taken these will get closed. label Feb 10, 2021
@github-actions github-actions bot added this to the v3.34.0 milestone Mar 25, 2021
@ghost
Copy link

ghost commented Mar 26, 2021

This has been released in version 3.34.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

@ghost
Copy link

ghost commented Apr 12, 2021

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

@ghost ghost locked as resolved and limited conversation to collaborators Apr 12, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
bug Addresses a defect in current functionality. service/ecr Issues and PRs that pertain to the ecr service. stale Old or inactive issues managed by automation, if no further action taken these will get closed.
Projects
None yet
4 participants