title: How to define the ' assume_role_policy' in terraform?
body: <p>Here is my aws_iam_role definition in terraform</p>
  
  <pre><code>resource "aws_iam_role" "server_role" {
    name = "server-role"
  
    assume_role_policy = &lt;&lt;EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Action": [
          "sts:AssumeEnvironment",
          "sqs:ChangeMessageVisibility",
          "sqs:ReceiveMessage",
          "sqs:SendMessage",
          "s3:GetObject*",
          "s3:ListBucket*",
          "s3:PutBucket*",
          "s3:PutObject*"
        ],
        "Principal": {
          "Service": "ec2.amazonaws.com"
        },
        "Effect": "Allow",
        "Sid": ""
      }
    ]
  }
  EOF
  </code></pre>
  
  <p>but i got this error when I try to run <code>terraform plan</code>:</p>
  
  <blockquote>
    <p>Error: Error applying plan:</p>
    
    <p>1 error(s) occurred:</p>
    
    <ul>
    <li><p>aws_iam_role.server_role: 1 error(s) occurred:</p></li>
    <li><p>aws_iam_role.server_role: Error creating IAM Role server-role: MalformedPolicyDocument: AssumeRole policy may
    only specify STS AssumeRole actions.  status code: 400, request id:
    55f1bfaf-a121-11e9-acaf-bb57d635757b</p></li>
    </ul>
  </blockquote>
  
  <p>I basically want to allow the server to read/write S3 buckets and read/write SQS queues.</p>
  
  <p>Apparently I cannot add all these <code>sqs:*</code> and <code>s3:*</code> in the same place. How can I do it in terraform?</p>