Cannot delete IAM role without permissions to delete non-existent RoleBoundary

[russellcardullo]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform Version

Terraform v0.11.7
+ provider.aws v1.31.0

Affected Resource(s)

• aws_iam_role

Terraform Configuration Files

resource "aws_iam_role" "test_role" {
  name = "test_role"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

Debug Output

https://gist.github.com/russellcardullo/bbbafc7e2ca7c9527d09cbff3319d807

Expected Behavior

Terraform would not make a call to delete role boundaries if I did not set any in the terraform config.

Actual Behavior

Terraform attempts to delete role boundaries which require the user to have additional permissions.

* aws_iam_role.test_role: Error deleting IAM Role test_role Permissions Boundary: AccessDenied: User: <REDACTED> is not authorized to perform: iam:DeleteRolePermissionsBoundary on resource: role test_role
	status code: 403, request id: 10c602a3-9c02-11e8-b99a-afafdbdaf63f

Steps to Reproduce

1. terraform apply

2. terraform destroy

Note, in my case I can add the additional permission to allow me to delete that. But it was surprising to me that I was able to create and delete resources like this before with the same permissions, but when updating to the latest terraform-aws provider I got this error.

Looks like this is a relatively new feature from AWS: https://aws.amazon.com/blogs/security/delegate-permission-management-to-developers-using-iam-permissions-boundaries/

I'm not sure if terraform always needs to delete role boundaries even if none exist. FWIW I can delete the role without issues through the AWS console without needing DeleteRolePermissionsBoundary permissions.

[mgarstecki]

I encountered this issue too while implementing permission boundaries in my context.

It seems the iam:DeleteRolePermissionsBoundary privilege should not be delegated to users bound by permission boundaries, else it can allow the user to break out of the boundary (see the "Important" section at the top of the doc).

It does not seem necessary to remove the permission boundary from the role prior to deleting it : I can confirm that an aws iam delete-role from the CLI works without deleting the permission boundary first.

Working on a PR to fix this.

[bflad]

Hi, folks. 👋 Sorry for the trouble here! This was an implementation mistake on my part. When I was adding this support to both the IAM user and IAM role resources, I discovered the IAM user resource required the permissions boundary deletion or it returned a deletion conflict so I just presumed the IAM role resource would need the same. The IAM role resource does not need this as noted above. 😅

Thanks @russellcardullo and @mgarstecki for reporting and fixing this! The fix (#5544) has been merged into master and will release with version 1.32.0 of the AWS provider, likely later today or tomorrow. 👍

[bflad]

This has been released in version 1.32.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!