{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/5979","repository_url":"https://api.github.com/repos/hashicorp/terraform","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/5979/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/5979/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/5979/events","html_url":"https://github.com/hashicorp/terraform/issues/5979","id":145225566,"number":5979,"title":"aws_iam_policy_attachment error when attaching amazon \"managed\" policies","user":{"login":"dansteen","id":64940,"avatar_url":"https://avatars.githubusercontent.com/u/64940?v=3","gravatar_id":"","url":"https://api.github.com/users/dansteen","html_url":"https://github.com/dansteen","followers_url":"https://api.github.com/users/dansteen/followers","following_url":"https://api.github.com/users/dansteen/following{/other_user}","gists_url":"https://api.github.com/users/dansteen/gists{/gist_id}","starred_url":"https://api.github.com/users/dansteen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dansteen/subscriptions","organizations_url":"https://api.github.com/users/dansteen/orgs","repos_url":"https://api.github.com/users/dansteen/repos","events_url":"https://api.github.com/users/dansteen/events{/privacy}","received_events_url":"https://api.github.com/users/dansteen/received_events","type":"User","site_admin":false},"labels":[{"id":85946957,"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7","default":true},{"id":127939518,"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2016-04-01T16:34:35Z","updated_at":"2016-11-01T01:28:55Z","closed_at":null,"body":"For the following config:  \n\n```\nresource \"aws_iam_role\" \"emr\" {\n    name = \"matching-spark-emr-${var.env}\"\n    assume_role_policy = \"${file(\"${path.module}/iam-policy-emr-trust-relationship.tpl\")}\"\n}\n\n# the generic role provided by amazon\nresource \"aws_iam_policy_attachment\" \"AmazonElasticMapReduceRole\" {\n  name = \"AmazonElasticMapReduceRole\"\n  roles = [ \"${aws_iam_role.emr.name}\" ]\n  policy_arn = \"arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole\"\n}\n```\n\nI Occasionally, get the following error:\n\n```\n* aws_iam_policy_attachment.AmazonElasticMapReduceRole: [WARN] Error updating user, role, or group list from IAM Policy Attachment AmazonElasticMapReduceRole:\n– NoSuchEntity: Policy arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole was not found.\n        status code: 404, request id: be6c2f10-f824-11e5-9241-eb1509222747\n```\n\nNote that I only seem to get this when attaching amazon \"managed\" policies to a role.   A second run results in success.   Also, as a note, the above code is in a module, and I call that module multiple times (despite the warning in the documentation about only using \"aws_iam_policy_attachment\" once per policy.\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/257468411","html_url":"https://github.com/hashicorp/terraform/issues/5979#issuecomment-257468411","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/5979","id":257468411,"user":{"login":"adamgotterer","id":223498,"avatar_url":"https://avatars.githubusercontent.com/u/223498?v=3","gravatar_id":"","url":"https://api.github.com/users/adamgotterer","html_url":"https://github.com/adamgotterer","followers_url":"https://api.github.com/users/adamgotterer/followers","following_url":"https://api.github.com/users/adamgotterer/following{/other_user}","gists_url":"https://api.github.com/users/adamgotterer/gists{/gist_id}","starred_url":"https://api.github.com/users/adamgotterer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamgotterer/subscriptions","organizations_url":"https://api.github.com/users/adamgotterer/orgs","repos_url":"https://api.github.com/users/adamgotterer/repos","events_url":"https://api.github.com/users/adamgotterer/events{/privacy}","received_events_url":"https://api.github.com/users/adamgotterer/received_events","type":"User","site_admin":false},"created_at":"2016-11-01T01:28:55Z","updated_at":"2016-11-01T01:28:55Z","body":"Took me a few hours, but I finally understand what the docs mean. Hopefully this will help someone else:\r\n\r\nThe policy arn can only be called one time ANY resource and ALL roles that need that policy need to be in a single resource. My above attempts turned into:\r\n\r\n```tf\r\nresource \"aws_iam_policy_attachment\" \"ecs_instance\" {\r\n  name = \"ecs-instance-policy-attachment\"\r\n  roles = [\r\n\t\"${module.ecs_public.instance_iam_profile_id}\",\r\n\t\"${module.ecs_private.instance_iam_profile_id}\"\r\n  ]\r\n  policy_arn = \"arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly\"\r\n}\r\n\r\nresource \"aws_iam_policy_attachment\" \"ecs_service\" {\r\n  name = \"ecs-service-policy-attachment\"\r\n  roles = [\r\n    \"${module.ecs_private.service_iam_profile_id}\",\r\n    \"${module.ecs_public.service_iam_profile_id}\"\r\n  ]\r\n  policy_arn = \"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole\"\r\n}\r\n```"}}
{"actor":{"display_login":"adamgotterer"}}