Terraform change the principal of the policy to assumed role - amazon-web-services

Question

The application is deployed in Fargate, and need to consume message from TRUCKDIM.fifo. To allow this, I granted all permissions to ecs-task-role.
The code looks like this in terraform, I am allowing the ecs-task-role to access the fifo queue TRUCKDIM.fifo with all the permissions.
resource "aws_sqs_queue" "queue_fifo-01" {
name = var.name
fifo_queue = var.fifo_queue
fifo_throughput_limit = var.fifo_throughput_limit
deduplication_scope = var.deduplication_scope
content_based_deduplication = var.content_based_deduplication
delay_seconds = var.delay_seconds
max_message_size = var.max_message_size
message_retention_seconds = var.message_retention_seconds
receive_wait_time_seconds = var.receive_wait_time_seconds
visibility_timeout_seconds = var.visibility_timeout_seconds
kms_master_key_id = var.kms_master_key_id
kms_data_key_reuse_period_seconds = var.kms_data_key_reuse_period_seconds
redrive_policy = jsonencode({
deadLetterTargetArn = aws_sqs_queue.queue_fifo-02.arn
maxReceiveCount = 10
})
policy = <<POLICY
{
"Version": "2012-10-17",
"Id": "Policy1676302010732",
"Statement": [
{
"Sid": "Stmt1676302006390",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::995556942157:role/service-role/ecs-task-role"
},
"Action": "sqs:*",
"Resource": "arn:aws:sqs:us-west-2:995556942157:TRUCKDIM.fifo"
}
]
}
POLICY
}
N.B: The role ecs-task-role is created via terraform.
When I run the terraform plan, the principal is correctly set
~ Principal = {
~ AWS = "AROA78POOLYTRE11KEEZA" -> "arn:aws:iam::995556942157:role/service-role/ecs-task-role"
}
After running terraform apply, and then check in the AWS console of the queue TRUCKDIM.fifo, the principal has changed to a string (assumed_role_id) "AROA6OPZZLYFIE6IYBEF4"
{
"Version": "2012-10-17",
"Id": "Policy1676302010732",
"Statement": [
{
"Sid": "Stmt1676302006390",
"Effect": "Allow",
"Principal": {
"AWS": "AROA6OPZZLYFIE6IYBEF4"
},
"Action": "sqs:*",
"Resource": "arn:aws:sqs:us-west-2:995556942157:TRUCKDIM.fifo"
}
]
}
Does someone know why, terraform is replacing the arn of the ecs-task-role to the assumed_rome_id ?
I am getting access denied to the TRUCKDIM.fifo in the log.
If I copy-paste the role directly in the AWS console, everything works.

Answer 1

It seems like this API is interpreting the ARN you provided and then replacing it with an equivalent Unique Identifier.
The difference between the two is:
An ARN uses the "friendly name" of an IAM object -- ecs-task-role in your case -- which is user-friendly but could potentially change meaning if you were to later destroy this role and then create a new role with the same name.
A unique ID is generated automatically by the IAM API and guaranteed to be unique across all objects that will ever exist. Each role you create will have a unique ID and if you delete that role and recreate one with the same name the new role will then have a distinct unique ID.
You can read more about these different identifier types in IAM identifiers.
My sense of what happened here is that the SQS API parsed your policy after Terraform submitted it and it noticed your ARN arn:aws:iam::995556942157:role/service-role/ecs-task-role and so made a query to the IAM API to find out whether there is a role named ecs-task-role. After looking it up, SQS now also knows the unique ID of this object and it seems to have stored that unique ID instead of the ARN you originally submitted, presumably so that it can "lock in" this particular role and not be tricked into using a different role if you were to delete ecs-task-role and make a new role of the same name later.
Unfortunately Terraform's AWS provider is not aware of this transformation and so from the provider's perspective this seems like the object was edited outside of Terraform and no longer matches the configuration. Although Terraform providers will typically notice when two values are equivalent, in this case that's harder because it would require the AWS provider to query the IAM API to determine whether role AROA6OPZZLYFIE6IYBEF4 has the name ecs-task-role.
Therefore I think the only way to make this configuration converge (that is: not continually propose to change the unique ID back into an ARN) would be to write the unique ID into the IAM policy instead.
One way to achieve that without hard-coding the unique ID would be to use the aws_iam_role data source to ask the IAM API to return the unique ID and then pass that value into your policy, like this:
data "aws_iam_role" "ecs_task" {
name = "ecs-task-role"
}
resource "aws_sqs_queue" "queue_fifo-01" {
# ...
policy = jsonencode({
# ...
Principal = {
AWS = data.aws_iam_role.ecs_task.unique_id
}
# ...
})
}
This unique_id attribute is defined by the aws_iam_role data source in the AWS provider to return the unique ID for the requested object. That should then cause the generated policy to include AROA6OPZZLYFIE6IYBEF4 instead of arn:aws:iam::995556942157:role/service-role/ecs-task-role and it will therefore match the way that the SQS API has stored this policy and therefore allow your configuration to converge.
(Note: I showed using jsonencode to generate the JSON here, instead of a <<POLICY "heredoc" template, because the policy content is now dynamic based and so using Terraform's JSON encoder is a robust way to ensure that the result will always be valid JSON without the need to do any special escaping. The details of that are beyond the scope of this question but if you'd like to learn more about that function please refer to its documentation.)