Menu

Post image 1
Post image 2
Post image 3
1 / 3
0

The IAM Trust Policy Chicken-and-Egg (That Isn't)

DEV Community·Glenn Gray·20 days ago
#svRaOzRe
#iam#terraform#aws#role#resource#dependency
Reading 0:00
15s threshold

Originally published on graycloudarch.com . The pipeline role needed to trust the deployment role. The deployment role needed to trust the pipeline role. When I wrote both in Terraform and ran plan, it stopped: Error: Cycle: module.pipeline.aws_iam_role.exec → module.deploy.aws_iam_role.target → module.pipeline.aws_iam_role.exec Enter fullscreen mode Exit fullscreen mode The instinct is to create one role first, then go back and edit the trust policy of the other after it exists. A manual bootstrap step. It works. It also means you can't terraform apply from a clean state and get a working result — someone has to remember the second pass. The IaC tells half the story. There's a better answer. IAM trust policies don't validate that the ARNs they reference actually exist. AWS stores the JSON document and moves on. The cycle Terraform sees is real — it's a real edge in its dependency graph. The underlying constraint that dependency represents is not.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More