{"action":"opened","issue":{"url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5984","repository_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws","labels_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5984/labels{/name}","comments_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5984/comments","events_url":"https://api.github.com/repos/terraform-providers/terraform-provider-aws/issues/5984/events","html_url":"https://github.com/terraform-providers/terraform-provider-aws/issues/5984","id":363661567,"node_id":"MDU6SXNzdWUzNjM2NjE1Njc=","number":5984,"title":"IAM policies that have a ${aws:username} component fail to parse properly","user":{"login":"hashibot[bot]","id":35615658,"node_id":"MDM6Qm90MzU2MTU2NTg=","avatar_url":"https://avatars2.githubusercontent.com/in/8332?v=4","gravatar_id":"","url":"https://api.github.com/users/hashibot%5Bbot%5D","html_url":"https://github.com/apps/hashibot","followers_url":"https://api.github.com/users/hashibot%5Bbot%5D/followers","following_url":"https://api.github.com/users/hashibot%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/hashibot%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/hashibot%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashibot%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/hashibot%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/hashibot%5Bbot%5D/repos","events_url":"https://api.github.com/users/hashibot%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/hashibot%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-25T16:20:01Z","updated_at":"2018-09-25T16:20:01Z","closed_at":null,"author_association":"NONE","body":"_This issue was originally opened by @aking1012 as hashicorp/terraform#18937. It was migrated here as a result of the [provider split](https://www.hashicorp.com/blog/upcoming-provider-changes-in-terraform-0-10/). The original body of the issue is below._\r\n\r\n<hr>\r\n\r\n### Terraform Version\r\n```\r\nTerraform v0.11.8\r\n+ provider.aws v1.37.0\r\n```\r\n\r\n### Terraform Configuration Files\r\n```hcl\r\nresource \"aws_iam_policy\" \"AllowManageVirtualMFA\" {\r\n    name        = \"AllowManageVirtualMFA\"\r\n    path        = \"/\"\r\n    description = \"Allow users to manage their own virtual MFA\"\r\n    policy      = <<POLICY\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"AllowUsersToCreateEnableResyncTheirOwnVirtualMFADevice\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:CreateVirtualMFADevice\",\r\n        \"iam:EnableMFADevice\",\r\n        \"iam:ResyncMFADevice\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}\",\r\n        \"arn:aws:iam::account-id-without-hyphens:user/${aws:username}\"\r\n      ]\r\n    },\r\n    {\r\n      \"Sid\": \"AllowUsersToDeactivateDeleteTheirOwnVirtualMFADevice\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:DeactivateMFADevice\",\r\n        \"iam:DeleteVirtualMFADevice\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::account-id-without-hyphens:mfa/${aws:username}\",\r\n        \"arn:aws:iam::account-id-without-hyphens:user/${aws:username}\"\r\n      ],\r\n      \"Condition\": {\r\n        \"Bool\": {\r\n          \"aws:MultiFactorAuthPresent\": true\r\n        }\r\n      }\r\n    },\r\n    {\r\n      \"Sid\": \"AllowUsersToListMFADevicesandUsersForConsole\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:ListMFADevices\",\r\n        \"iam:ListVirtualMFADevices\",\r\n        \"iam:ListUsers\"\r\n      ],\r\n      \"Resource\": \"*\"\r\n    }\r\n  ]\r\n}\r\nPOLICY\r\n}\r\n\r\nresource \"aws_iam_policy\" \"ForceMFAAndAllowMFAManagement\" {\r\n    name        = \"ForceMFAAndAllowMFAManagement\"\r\n    path        = \"/\"\r\n    description = \"Forces MFA and allows management of MFA.  Without MFA, users can only access IAM\"\r\n    policy      = <<POLICY\r\n{\r\n  \"Version\": \"2012-10-17\",\r\n  \"Statement\": [\r\n    {\r\n      \"Sid\": \"AllowAllUsersToListAccounts\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:ListAccountAliases\",\r\n        \"iam:ListUsers\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::057174720035:user/*\"\r\n      ]\r\n    },\r\n    {\r\n      \"Sid\": \"AllowIndividualUserToSeeTheirAccountInformation\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:ChangePassword\",\r\n        \"iam:CreateLoginProfile\",\r\n        \"iam:DeleteLoginProfile\",\r\n        \"iam:GetAccountPasswordPolicy\",\r\n        \"iam:GetAccountSummary\",\r\n        \"iam:GetLoginProfile\",\r\n        \"iam:UpdateLoginProfile\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::057174720035:user/${aws:username}\"\r\n      ]\r\n    },\r\n    {\r\n      \"Sid\": \"AllowIndividualUserToListTheirMFA\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:ListVirtualMFADevices\",\r\n        \"iam:ListMFADevices\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::057174720035:mfa/*\",\r\n        \"arn:aws:iam::057174720035:user/${aws:username}\"\r\n      ]\r\n    },\r\n    {\r\n      \"Sid\": \"AllowIndividualUserToManageThierMFA\",\r\n      \"Effect\": \"Allow\",\r\n      \"Action\": [\r\n        \"iam:CreateVirtualMFADevice\",\r\n        \"iam:DeactivateMFADevice\",\r\n        \"iam:DeleteVirtualMFADevice\",\r\n        \"iam:EnableMFADevice\",\r\n        \"iam:ResyncMFADevice\"\r\n      ],\r\n      \"Resource\": [\r\n        \"arn:aws:iam::057174720035:mfa/${aws:username}\",\r\n        \"arn:aws:iam::057174720035:user/${aws:username}\"\r\n      ]\r\n    },\r\n    {\r\n      \"Sid\": \"DoNotAllowAnythingOtherThanAboveUnlessMFAd\",\r\n      \"Effect\": \"Deny\",\r\n      \"NotAction\": \"iam:*\",\r\n      \"Resource\": \"*\",\r\n      \"Condition\": {\r\n        \"Null\": {\r\n          \"aws:MultiFactorAuthAge\": \"true\"\r\n        }\r\n      }\r\n    }\r\n  ]\r\n}\r\nPOLICY\r\n}\r\n```\r\n\r\n### Debug Output\r\nThere's a counter-intuitive error message in this scenario that involves an unclosed brace, when it's actually just not parsing properly.\r\n  \r\n### Expected Behavior\r\nInit and apply work.\r\n\r\n### Actual Behavior\r\nEven init bombs out, because the parser chokes.\r\n\r\n### Steps to Reproduce\r\nTry to perform a `terraform init` with the said IAM policies in a tf file.\r\n\r\n### Additional Context\r\nNothing special.  Standalone configuration.\r\n\r\n### References\r\nNone that I am aware of."}}
{"actor":{"display_login":"hashibot"}}