Make Terraform ignore the order of list items returned from the service

Viewed 4222

I'm creating an AWS IAM policy that grants access to a resource to a number of remote accounts. I've got these accounts in a list - all good. However when TF checks the current state on the subsequent plan it comes back in a different order and TF thinks that it must be corrected. How can I ignore the list order?

This is my resource:

resource "aws_ecr_repository_policy" "repo" {
  policy = jsonencode({
    Statement = [
      {
        Principal = {
          AWS = [ 
              "arn:aws:iam::123456789012:root",
              "arn:aws:iam::567890123456:root",
              "arn:aws:iam::987654321098:root",
          ]
...

Now on subsequent terraform plan runs I get some variations of this:

~ {
    ~ Principal = {
      ~ AWS = [
        + "arn:aws:iam::987654321098:root",    <<< swapped order
          "arn:aws:iam::123456789012:root",
          "arn:aws:iam::567890123456:root",
        - "arn:aws:iam::987654321098:root",    <<< and here
      ]
    }

AWS is unpredictable with the order it returns, it changes each time. Can I somehow ignore the order? Ideally without ignoring the whole policy block with lifecycle / ignore_changes.

1 Answers
Related