title: Terraform unable to assume IAM Role
body: <p>I am trying to get started with Terraform and am using GitLab CI/CD to interact with it. My Runner is unable to assume the IAM Role which has elevated privileges to create AWS resources. My Google-fu on this has failed me.</p>
  <p>The error received is:</p>
  <blockquote>
  <p>Error: error configuring Terraform AWS Provider: IAM Role
  (my:arn) cannot be assumed. There are a number of possible causes of this - the most common are:</p>
  <ul>
  <li>The credentials used in order to assume the role are invalid</li>
  <li>The credentials do not have appropriate permission to assume the role</li>
  <li>The role ARN is not valid</li>
  </ul>
  </blockquote>
  <p>I have created an access/secret key in IAM and have attempted supplying these as GitLab CI/CD Variables, environment variables that I directly <code>export</code> in my <code>before_script</code>, and even the not-recommended hardcoding them into the <code>provider</code> stanza. No matter what, I still get this same error.</p>
  <p>What is extra strange is that AWS shows that the key is being used. The &quot;Last Used&quot; column will always reflect a timestamp of the last attempt at running the pipeline. For better or worse, the key is part of my root AWS account - this is a sandbox project and I don't have any IAM Users, so, it's not clear to me how Terraform is unable to use these credentials to assume a Role when, according to AWS, it's able to access my account with them, and my account has root privileges.</p>
  <p>Here is my <code>provider.tf</code>:</p>
  <pre><code>terraform {
      required_version = &quot;&gt;= 0.14&quot;
      backend &quot;s3&quot; { }
  }
  
  provider &quot;aws&quot; {
      region = &quot;us-east-1&quot;
      access_key = &quot;redacted&quot;
      secret_key = &quot;redacted&quot;
      assume_role {
          role_arn = &quot;arn:aws:iam::redacted:role/gitlab-runner-role&quot;
      }
  }
  </code></pre>
  <p>Here is the relevant section of my <code>.gitlab-ci.yml</code> for this stage:</p>
  <pre><code>.terraform_init: &amp;terraform_init |-
    terraform init -backend-config=&quot;bucket=my-terraform-state&quot; -backend-config=&quot;region=us-east-1&quot; -backend-config=&quot;key=terraform.tfstate&quot;
  
  tf-plan:
    image: 
      name: hashicorp/terraform
      entrypoint: [&quot;&quot;]
    stage: plan
    before_script:
      - *terraform_init
    script:
      - terraform plan -out=tfplan.plan
      - terraform show --json tfplan.plan | convert_report &gt; tfplan.json
    needs:
      - job: tf-val
    tags:
      - my-runner
  </code></pre>
  <p>My <code>main.tf</code> only contains a basic <code>aws_instance</code> stanza and my <code>terraform validate</code> stage (omitted above) says it's in ship-shape. These are the only 3 files in my repo.</p>
  <p>My <code>gitlab-runner-role</code> only contains one Policy, <code>gitlab-runner-policy</code>, whose JSON is:</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;VisualEditor0&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Action&quot;: [
                  &quot;s3:PutObject&quot;,
                  &quot;s3:GetObject&quot;,
                  &quot;s3:ListBucket&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::*/*&quot;,
                  &quot;arn:aws:s3:::my-terraform-state&quot;
              ]
          }
      ]
  }
  </code></pre>
  <p>TIA for any advisement... really banging my head up against the wall on this one.</p>