Failed to update trust policy. Invalid principal in policy for aws china

[hsalluri259]

Description

I am trying to create an ECS resource in AWS china without changing any values in the module, but the ARN for principal is wrong in aws china. Even in china it has to be amazonaws.com not amazonaws.com.cn

If your request is for a new feature, please use the Feature request template.

• ✋ I have searched the open/closed issues and my issue is not listed.

⚠️ Note

Before you submit an issue, please perform the following first:
Yes, I performed all these steps.

1. Remove the local .terraform directory (! ONLY if state is stored remotely, which hopefully you are following that best practice!): rm -rf .terraform/
2. Re-initialize the project root to pull down modules: terraform init
3. Re-attempt your terraform plan or apply and check if the issue still persists

Versions

• Module version [Required]:
  Downloading registry.terraform.io/terraform-aws-modules/alb/aws 8.7.0 for example.alb...
  Downloading registry.terraform.io/terraform-aws-modules/security-group/aws 4.17.2 for example.alb_sg...
  Downloading registry.terraform.io/terraform-aws-modules/ecs/aws 5.2.0 for example.ecs...
  Downloading registry.terraform.io/terraform-aws-modules/ecs/aws 5.2.2 for example.ecs_cluster...
• • Installing hashicorp/aws v5.22.0...
• Installed hashicorp/aws v5.22.0 (signed by HashiCorp)
• Terraform version:
• Terraform v1.5.7
• Provider version(s):

Terraform v1.5.7
on darwin_amd64

• provider registry.terraform.io/hashicorp/aws v5.22.0

Reproduction Code [Required]

provider.tf

terraform {
  required_providers {
    aws = {
      source = "hashicorp/aws"
    }
  }
  backend "s3" {
    bucket  = "mic-terraform-cpeteam"
    key     = "ecs.tfstate"
    region  = "cn-north-1"
    profile = "mystranpr"
  }
}

provider "aws" {
  region  = "cn-north-1"
  profile = "mystranpr"
}

example.tf

module "example" {
  source       = "../../module"
  cluster_name = "harish"
  environment  = "test"
  owner        = "harish-test"
  mic_project  = "example"
  # region         = "cn-north-1"            # the region where the S3 bucket is located
  vpc_id         = "vpc-0990f986c095751a4" # This will come from the vpc module 
  container_name = "ecsdemo-frontend"
  namespace      = "example1"

  services = {}
  
  additonal_tags = {
    "test" = "test"
  }
  
  }

../../module/main.tf

module "ecs" {
  source  = "terraform-aws-modules/ecs/aws"
  version = "5.2.0"

  cluster_name = local.cluster_name

  default_capacity_provider_use_fargate = true
  create_cloudwatch_log_group           = false

  cluster_configuration = {
    execute_command_configuration = {
      logging = "OVERRIDE"
      log_configuration = {
        cloud_watch_log_group_name = "/aws/ecs/aws-ec2/${local.cluster_name}-logs"
      }
    }
  }

  services = local.services

  create_task_exec_iam_role = true
  create_task_exec_policy   = true
  task_exec_iam_role_name   = local.cluster_name
  task_exec_secret_arns     = ["arn:${data.aws_partition.current.partition}:secretsmanager:*:*:secret:*"]
  task_exec_ssm_param_arns  = ["arn:${data.aws_partition.current.partition}:ssm:*:*:parameter/*"]
  tags                      = local.tags
}

Steps to reproduce the behavior:

No

Expected behavior

It created ecs tasks in AWS Commerical without any error.

Actual behavior

In AWS China it's throwing the error because the code is using dns_suffix from data "aws_partition" "current" {} This add amazonaws.com.cn instead of amazonaws.com

Error: creating IAM Role (harish-test-20231024220051883700000004): MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ecs-tasks.amazonaws.com.cn"
│ 	status code: 400, request id: 5dfe4253-bfdc-4017-b79b-71e69648eede
│
│   with module.example.module.ecs.module.cluster.aws_iam_role.task_exec[0],
│   on .terraform/modules/example.ecs/modules/cluster/main.tf line 202, in resource "aws_iam_role" "task_exec":
│  202: resource "aws_iam_role" "task_exec" {
│
╵
╷
│ Error: creating IAM Role (harish-test-20231024220051882500000001): MalformedPolicyDocument: Invalid principal in policy: "SERVICE":"ecs-tasks.amazonaws.com.cn"
│ 	status code: 400, request id: 86bb015b-c085-48b0-9175-cb47bdaa3e89
│
│   with module.example.module.ecs_cluster.aws_iam_role.task_exec[0],
│   on .terraform/modules/example.ecs_cluster/modules/cluster/main.tf line 202, in resource "aws_iam_role" "task_exec":
│  202: resource "aws_iam_role" "task_exec" {
│

Terminal Output Screenshot(s)

## Additional context

[antonbabenko]

This issue has been resolved in version 5.5.0 🎉

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.