How to escape HCL string containing ${aws:username} in "Resource" section?

user_1600885 0
Viewed 3927

How to escape HCL string containing ${aws:username} in "Resource" section?

I currently use Terraform version 0.9.9 to create AWS policies in a main.tf file in following way: 

resource "aws_iam_group_policy" "AllowIndividualUserToSeeTheirAccountInformation" {
      name  = "AllowIndividualUserToSeeTheirAccountInformation"
      group = "${aws_iam_group.pr_faas_developers.id}"

      policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }
    EOF
    }

When doing so, Terraform tries to interpolate ${aws:username} and terraform is going to fail as follows 

terraform.exe plan
Failed to load root config module: Error loading D:\amazonaws-root-master\main.t
f: Error reading config for aws_iam_group_policy[AllowIndividualUserToSeeTheirAc
countInformation]: parse error at 17:51: expected "}" but found ":"

When I'm escaping the resource string as follows: 

"Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws\\:username\\}"
        ]

"terraform plan" and "terraform apply" is going to work fine but the result within AWS show policy is: 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
            "iam:ChangePassword",
            "iam:CreateLoginProfile",
            "iam:DeleteLoginProfile",
            "iam:GetAccountPasswordPolicy",
            "iam:GetAccountSummary",
            "iam:GetLoginProfile",
            "iam:UpdateLoginProfile"
      ],
      "Effect": "Allow",
      "Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws:username\\}"
        ]

    }
  ]
}

which is different from the expected outcome: 

 {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }

Is there any solution to escape "arn:aws:iam::XXXXXXXXX:user/${aws:username}" within the terraform main.tf file for the desired outcome?

terraform amazon-web-services
4 Answers

Recently running into similar string literal issue, copy the response into here to help more folks.

Note, this still applies with Terraform 0.12.

"In both quoted and heredoc string expressions, Terraform supports template sequences that begin with ${ and %{."

"To include these sequences literally without beginning a template sequence, double the leading character: $${ or %%{."

Please have a look at the docs for more details.

user_7916090

https://registry.terraform.io/providers/hashicorp/aws/2.69.0/docs/data-sources/iam_policy_document#context-variable-interpolation

The IAM policy document format allows context variables to be interpolated into various strings within a statement. The native IAM policy document format uses ${...}-style syntax that is in conflict with Terraform's interpolation syntax, so this data source instead uses &{...} syntax for interpolations that should be processed by AWS rather than by Terraform.

so you can do

    resources = [
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
    ]
user_5508660

There are 2 solutions:

  1. Escape that variable in shell script using an extra $ before it. For example, PROJECT=$${project}
  2. Add that variable as project = "$project" under the list of variables for file in terraform script and it will replace ${project} with $project and the script will still work.
user_117588430
Related