title: Terraform, getting output from null_resource, local-exec and the AWS CLI
body: <p>I'm using Terraform to automate provision of Cognito Identity Pools in AWS. The AWS provider doesn't support Cognito yet so I've been using null_resource and local-exec to call the AWS CLI.</p>
  
  <p>I have the following resource:</p>
  
  <pre><code>resource "null_resource" "create-identitypool" {
      provisioner "local-exec" {
          command = "aws cognito-identity create-identity-pool --identity-pool-name terraform_identitypool --no-allow-unauthenticated-identities --developer-provider-name login.terraform.myapp"
      }
  }
  </code></pre>
  
  <p>which gives the following output:</p>
  
  <pre><code>null_resource.create-identitypool (local-exec): {
  null_resource.create-identitypool (local-exec):     "IdentityPoolId": "eu-west-1:22549ad3-1611-......",
  null_resource.create-identitypool (local-exec):     "AllowUnauthenticatedIdentities": false,
  null_resource.create-identitypool (local-exec):     "DeveloperProviderName": "login.terraform.myapp",
  null_resource.create-identitypool (local-exec):     "IdentityPoolName": "terraform_identitypool"
  null_resource.create-identitypool (local-exec): }
  null_resource.create-identitypool: Creation complete
  </code></pre>
  
  <p>The next step is to add some roles, which I've already created, to the identity pool:</p>
  
  <pre><code>resource "null_resource" "attach-policies-identitypool" {
      provisioner "local-exec" {
          command = "aws cognito-identity set-identity-pool-roles --identity-pool-id ${null_resource.create-identitypool.IdentityPoolId} --roles authenticated=authroleXXX,unauthenticated=unauthroleXXX"
      }
  }
  </code></pre>
  
  <p>The issue is that I'm unable to extract the IdentityPoolId, ${null_resource.create-identitypool.IdentityPoolId}, to use in the second resource. I understand the null_resource doesn't have output attributes, so how can I get this JSON object out of the command line output. I'll also want to use tirggers and run aws cognito-identity list-identity-pools and possibly delete-identity-pool to make this all repeatable from which I'll also need the output.</p>
  
  <p>Any ideas? And apologies if I've missed this information somewhere else. I've also asked this question on the Terraform mailing list, but I thought I'd try for a wider audience.</p>
  
  <p>Thanks,
  Tim</p>