title: Terraform: Issue with assume_role
body: <p>I'm trying to solve this mystery for few days now, but no joy. Basically, <strong>Terraform cannot assume role</strong> and failing with:</p>
  
  <pre><code>Initializing the backend...
  2019/10/28 09:13:09 [DEBUG] New state was assigned lineage "136dca1a-b46b-1e64-0ef2-efd6799b4ebc"
  2019/10/28 09:13:09 [INFO] Setting AWS metadata API timeout to 100ms
  2019/10/28 09:13:09 [INFO] Ignoring AWS metadata API endpoint at default location as it doesn't return any instance-id
  2019/10/28 09:13:09 [INFO] AWS Auth provider used: "SharedCredentialsProvider"
  2019/10/28 09:13:09 [INFO] Attempting to AssumeRole arn:aws:iam::72xxxxxxxxxx:role/terraform-admin-np (SessionName: "terra_cnp", ExternalId: "", Policy: "")
  
  Error: The role "arn:aws:iam::72xxxxxxxxxx:role/terraform-admin-np" cannot be assumed.
  
    There are a number of possible causes of this - the most common are:
      * The credentials used in order to assume the role are invalid
      * The credentials do not have appropriate permission to assume the role
      * The role ARN is not valid
  </code></pre>
  
  <h3>In AWS:</h3>
  
  <p>I have <strong>role</strong>: <code>terraform-admin-np</code> with 2 <em>AWS managed policy</em>: <code>AmazonS3FullAccess</code> &amp; <code>AdministratorAccess</code> and a trust relationship with this:</p>
  
  <pre><code>  "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "AWS": "arn:aws:iam::72xxxxxxxxxx:root"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  </code></pre>
  
  <p>Then I have an <strong>user</strong> with policy document attached:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "TfFullAccessSts",
              "Effect": "Allow",
              "Action": [
                  "sts:AssumeRole",
                  "sts:DecodeAuthorizationMessage",
                  "sts:AssumeRoleWithSAML",
                  "sts:AssumeRoleWithWebIdentity"
              ],
              "Resource": "*"
          },
          {
              "Sid": "TfFullAccessAll",
              "Effect": "Allow",
              "Action": "*",
              "Resource": [
                  "*",
                  "arn:aws:ec2:region:account:network-interface/*"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>and a <strong>S3 bucket</strong>: <code>txxxxxxxxxxxxxxte</code> with this policy document attached:</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "TFStateListBucket",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::72xxxxxxxxxx:root"
              },
              "Action": "s3:ListBucket",
              "Resource": "arn:aws:s3:::txxxxxxxxxxxxxxte"
          },
          {
              "Sid": "TFStateGetPutObject",
              "Effect": "Allow",
              "Principal": {
                  "AWS": "arn:aws:iam::72xxxxxxxxxx:root"
              },
              "Action": [
                  "s3:GetObject",
                  "s3:PutObject"
              ],
              "Resource": "arn:aws:s3:::txxxxxxxxxxxxxxte/*"
          }
      ]
  }
  </code></pre>
  
  <h3>In Terraform:</h3>
  
  <p>The snippet from the <code>provider.tf</code>: </p>
  
  <pre><code>###---- Default Backend and Provider config values -----------###
  terraform {
    required_version = "&gt;= 0.12"
    backend "s3" {
      encrypt  = true
    }
  }
  
  provider "aws" {
    region  = var.region
    version = "~&gt; 2.20"
    profile = var.profile
    assume_role {
      role_arn     = var.role_arn
      session_name = var.session_name
    }
  }
  </code></pre>
  
  <p>Snippet from <code>tgw_cnp.tfvars</code> backend config: </p>
  
  <pre><code>## S3 backend config
  key             = "backend/tgw_cnp_state"
  bucket          = "txxxxxxxxxxxxxxte"
  region          = "us-east-2"
  profile         = "local-tgw"
  role_arn        = "arn:aws:iam::72xxxxxxxxxx:role/terraform-admin-np"
  session_name    = "terra_cnp"
  </code></pre>
  
  <p>and then running this way:</p>
  
  <pre><code>TF_LOG=debug terraform init -backend-config=tgw_cnp.tfvars
  </code></pre>
  
  <p>With this, I can assume role using AWS CLI without any issue:</p>
  
  <pre><code># aws --profile local-tgw sts assume-role --role-arn "arn:aws:iam::72xxxxxxxxxx:role/terraform-admin-np" --role-session-name AWSCLI
  {
      "Credentials": {
          "AccessKeyId": "AXXXXXXXXXXXXXXXXXXA",
          "SecretAccessKey": "UixxxxxxxxxxxxxxxxxxxxxxxxxxxxMt",
          "SessionToken": "FQoGZXIvYXdzEJb//////////wEaD......./5LFwNWf6riiNw9vtBQ==",
          "Expiration": "2019-10-28T13:39:41Z"
      },
      "AssumedRoleUser": {
          "AssumedRoleId": "AROA2P7ZON5TSWMOBQEBC:AWSCLI",
          "Arn": "arn:aws:sts::72xxxxxxxxxx:assumed-role/terraform-admin-np/AWSCLI"
      }
  }
  </code></pre>
  
  <p>but terraform fails with the above error. Any idea what's I'm doing wrong?</p>