Handle "all policies deleted" corner case

[marcinwyszynski]

When the user intends to delete all policies, they don't delete any.
This also leads to an inconsistent state which will show changes on every plan.

[tyrannosaurus-becks]

Hi @marcinwyszynski ! Thanks for working on this.

Question. Correct me if I'm mistaken, but aren't policies required for a role to be valid? Why would a person want to delete policies without deleting the entire role?

Just trying to understand the use case. Thanks!

[marcinwyszynski]

Hey @tyrannosaurus-becks, I believe that if don't set policies explicitly, the role will be assigned a default policy, well... by default :) That's what's causing the problem, really - you're trying to set an empty list from Terraform, but Vault set the default policy, which gets reported back when you do the read, and makes Terraform want to change the resource again. Hope I'm making some sense :)

[marcinwyszynski]

Referring to your question explicitly:

Why would a person want to delete policies without deleting the entire role?

To make the role only use the implicit "default" policy.

[tyrannosaurus-becks]

Thanks @marcinwyszynski ! That makes sense!