title: How to escape HCL string containing ${aws:username} in "Resource" section?
body: <p><strong>How to escape HCL string containing ${aws:username} in "Resource" section?</strong> </p>
  
  <p>I currently use Terraform version 0.9.9 to create AWS policies in a main.tf file in following way:  </p>
  
  <pre><code>resource "aws_iam_group_policy" "AllowIndividualUserToSeeTheirAccountInformation" {
        name  = "AllowIndividualUserToSeeTheirAccountInformation"
        group = "${aws_iam_group.pr_faas_developers.id}"
  
        policy = &lt;&lt;EOF
      {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Action": [
                  "iam:ChangePassword",
                  "iam:CreateLoginProfile",
                  "iam:DeleteLoginProfile",
                  "iam:GetAccountPasswordPolicy",
                  "iam:GetAccountSummary",
                  "iam:GetLoginProfile",
                  "iam:UpdateLoginProfile"
            ],
            "Effect": "Allow",
            "Resource":
            [
                  "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
              ]
  
          }
        ]
      }
      EOF
      }
  </code></pre>
  
  <p>When doing so, Terraform tries to interpolate <code>${aws:username}</code> and terraform is going to fail as follows </p>
  
  <pre><code>terraform.exe plan
  Failed to load root config module: Error loading D:\amazonaws-root-master\main.t
  f: Error reading config for aws_iam_group_policy[AllowIndividualUserToSeeTheirAc
  countInformation]: parse error at 17:51: expected "}" but found ":"
  </code></pre>
  
  <p>When I'm escaping the resource string as follows:  </p>
  
  <pre><code>"Resource":
        [
              "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws\\:username\\}"
          ]
  </code></pre>
  
  <p><code>"terraform plan"</code> and <code>"terraform apply"</code> is going to work fine but the result within AWS show policy is: </p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
              "iam:ChangePassword",
              "iam:CreateLoginProfile",
              "iam:DeleteLoginProfile",
              "iam:GetAccountPasswordPolicy",
              "iam:GetAccountSummary",
              "iam:GetLoginProfile",
              "iam:UpdateLoginProfile"
        ],
        "Effect": "Allow",
        "Resource":
        [
              "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws:username\\}"
          ]
  
      }
    ]
  }
  </code></pre>
  
  <p>which is different from the expected outcome: </p>
  
  <pre><code> {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Action": [
                  "iam:ChangePassword",
                  "iam:CreateLoginProfile",
                  "iam:DeleteLoginProfile",
                  "iam:GetAccountPasswordPolicy",
                  "iam:GetAccountSummary",
                  "iam:GetLoginProfile",
                  "iam:UpdateLoginProfile"
            ],
            "Effect": "Allow",
            "Resource":
            [
                  "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
              ]
  
          }
        ]
      }
  </code></pre>
  
  <p>Is there any solution to escape <code>"arn:aws:iam::XXXXXXXXX:user/${aws:username}"</code> within the terraform main.tf file for the desired outcome?  </p>