Terraform Core Version

1.6.2

AWS Provider Version

5.25.0

Affected Resource(s)

aws_iam_role_policy_attachment

Expected Behavior

It should be possible to assign multiple policies to the same role.

Actual Behavior

When multiple policies are assigned, it very often fails with ConcurrentModification exception. It may be related to some changes in AWS, since the same code, with the same version of terraform and aws provider was working last week.

Relevant Error/Panic Output Snippet

Error: attaching policy arn:aws:iam::12545454:policy/test-policy-5 to IAM Role test-role: ConcurrentModification: Another request updating the entity is in progress. Please try again later.
│ 	status code: 409, request id: aaaaa-bbbbb-ccccc-ddddd-fea34e635b6a
│
│   with aws_iam_role_policy_attachment.test_attach[5],
│   on init.tf line 101, in resource "aws_iam_role_policy_attachment" "test_attach":
│  101: resource "aws_iam_role_policy_attachment" "test_attach" {

Terraform Configuration Files

variable "profile" {}
variable "region" {}

provider "aws" {
  profile = var.profile
  region  = var.region
}

terraform {
  required_version = ">= 1.0"
  backend "s3" {
    key = "spikes/role-benchmark/terraform.tfstate"
  }
  required_providers {
    aws = {
      source ="hashicorp/aws"
      version = "= 5.25.0"
    }

  }
}


data "aws_iam_policy_document" "assume_role" {
  statement {
    effect = "Allow"

    principals {
      type        = "Service"
      identifiers = ["ec2.amazonaws.com"]
    }

    actions = ["sts:AssumeRole"]
  }
}

resource "aws_iam_role" "role" {
  name               = "test-role"
  assume_role_policy = data.aws_iam_policy_document.assume_role.json
}

data "aws_iam_policy_document" "policy" {
  statement {
    effect    = "Allow"
    actions   = ["ec2:Describe*"]
    resources = ["*"]
  }
}

resource "aws_iam_policy" "policy" {
  count = 8
  name        = "test-policy-${count.index}"
  description = "A test policy"
  policy      = data.aws_iam_policy_document.policy.json
}


resource "aws_iam_role_policy_attachment" "test_attach" {
  count = 8
  role       = aws_iam_role.role.name
  policy_arn = aws_iam_policy.policy[count.index].arn
}

Steps to Reproduce

apply the provided terraform. Or create new terraform, which assigns 8 polices to a role

Debug Output

No response

Panic Output

No response

Important Factoids

No response

References

No response

Would you like to implement a fix?

None