2

I need to create several iam policies from json files. So, I've a file called iam_policies.tf with many of these code:


resource "aws_iam_policy" "name" {
  name        = "policy-name"
  description = "Policy desc xxx"
  path        = "/"

  policy = file("${path.module}/_/iam_policies/policy.json")
}

In a module I would like to use these policies as argument of var, but when I try to attach the policy...

resource "aws_iam_role_policy_attachment" "me" {
  for_each   = toset(var.policies)
  role       = aws_iam_role.me.name
  policy_arn = each.value
}

I get the error: The "for_each" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. To work around this, use the -target argument to first apply only the resources that the for_each depends on.

This is the module that create policies resources and other resources:

module "admin" {
  source = "./repo/module_name"

  policies = [
    aws_iam_policy.common.arn,
    aws_iam_policy.ses_sending.arn,
    aws_iam_policy.athena_readonly.arn,
    aws_iam_policy.s3_deploy.arn,
  ]
...
}

I've tried with depends_on but It doesn't works.

I'm using terraform cloud, so I can't use apply -target

How can I do? What's wrong? Thank you

Daniele
  • 538
  • 1
  • 5
  • 17
  • How did it go? Still unclear what you can do? – Marcin Dec 21 '21 at 02:21
  • I applied the policies and then the resources. But I need to understand how can I apply policies and resource with just one apply. I don't know how to do with CI/CD – Daniele Dec 21 '21 at 10:48
  • You can't do it in one apply. You would have to fully rearchitect your design. – Marcin Dec 21 '21 at 10:50

1 Answers1

0

If you can't use target, you have to separate your deployments into two deployments. First you deploy your policies, and then they will become inputs of the main deployment.

Marcin
  • 215,873
  • 14
  • 235
  • 294
  • Ok thank you. But, is there a way to deploy everything one single time? Maybe I need to rewrite all tf code in a different way ? – Daniele Dec 20 '21 at 07:35
  • @Daniele You can create a simple CI/CD pipeline what will take care of all the deployments for you. – Marcin Dec 20 '21 at 07:45