Terraform AWS MalformedPolicyDocument: Invalid principal in policy - amazon-web-services

Question

I probably misunderstand something about IAM permissions. I need a Lambda function to generate STS tokens, and here is my terraform to do that:
resource "aws_iam_role" "cloudfront_logs_to_es_lambda_role" {
name = "cloudfront-logs-to-elasticsearch-test"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Sid": "AllowlambdaToAssumeRole",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::MY-ACCOUNT-ID:role/cloudfront-logs-to-elasticsearch-test"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
This code raises this error: MalformedPolicyDocument: Invalid principal in policy: "AWS":"arn:aws:iam::MY-ACCOUNT-ID:role/cloudfront-logs-to-elasticsearch-test"
I understand that I cannot put in the assume_role_policy a role that I am creating in the same time.
However, my question is: How can I attach this statement:
{
"Sid": "AllowlambdaToAssumeRole",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::MY-ACCOUNT-ID:role/cloudfront-logs-to-elasticsearch-test"
},
"Action": "sts:AssumeRole"
}
to the role, after creating the role.
The only way I could make my code work is by first making a terraform apply of:
resource "aws_iam_role" "cloudfront_logs_to_es_lambda_role" {
name = "cloudfront-logs-to-elasticsearch-${local.env_type}"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
And then making:
resource "aws_iam_role" "cloudfront_logs_to_es_lambda_role" {
name = "cloudfront-logs-to-elasticsearch-test"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
},
{
"Sid": "AllowlambdaToAssumeRole",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::MY-ACCOUNT-ID:role/cloudfront-logs-to-elasticsearch-test"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
Edit:
Here is the Python code that requires the role can assume itself for STS token generation:
sts = boto3.client("sts")
creds = sts.assume_role(RoleArn=terraform_role_arn, RoleSessionName="lambdastsassume")