AWS ECR Policy - need to run terraform apply twice

[vikas027]

Terraform Version

~$ terraform -v
Terraform v0.8.7

Affected Resource(s)

• aws_ecr_repository
• aws_ecr_repository_policy

Terraform Configuration Files

resource "aws_iam_role_policy" "ecr_admin_policy" {
    name = "ecr_admin_policy"
    role = "${aws_iam_role.ecr_admin_role.id}"
    policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "ecr:*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

resource "aws_iam_role" "ecr_admin_role" {
  name = "${var.iam_role}"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service": "ecs.amazonaws.com"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}
EOF
}

resource "aws_ecr_repository" "images" {
  depends_on = [ "aws_iam_role_policy.ecr_admin_policy", "aws_iam_role.ecr_admin_role" ]
  count = "${length(var.list_of_images)}",
  name  = "${element(var.list_of_images, count.index)}"
}

resource "aws_ecr_repository_policy" "repo_policy" {
  count = "${length(var.list_of_images)}"
  repository = "${element(aws_ecr_repository.images.*.id, count.index)}"
  policy = <<POLICY
{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "repo_policy",
            "Effect": "Allow",
            "Principal": {
              "AWS": [
                "arn:aws:iam::11111111111111:root",
                "arn:aws:iam::11111111111111:role/ecr_admin"
              ]
            },
            "Action": [
                "ecr:GetDownloadUrlForLayer",
                "ecr:BatchGetImage",
                "ecr:BatchCheckLayerAvailability",
                "ecr:PutImage",
                "ecr:InitiateLayerUpload",
                "ecr:UploadLayerPart",
                "ecr:CompleteLayerUpload",
                "ecr:DescribeRepositories",
                "ecr:GetRepositoryPolicy",
                "ecr:ListImages",
                "ecr:DeleteRepository",
                "ecr:BatchDeleteImage",
                "ecr:SetRepositoryPolicy",
                "ecr:DeleteRepositoryPolicy"
            ]
        }
    ]
}
POLICY
}

Debug Output

First Run terraform apply (fails)
Second Run terraform apply (succeeds)

Expected Behavior

terraform apply should not complain about the policy.

Actual Behavior

terraform apply complains about invalid policy on the first run. And then creates ECR policy in the second run.
I have tried to set resource dependencies using depends_on in vain, behavior is same without this parameter.

Steps to Reproduce

Please list the steps required to reproduce the issue, for example:

1. terraform apply (throws an error)
2. terraform apply (run okay this time)

References

Few other similar issues where terraform does not wait for enough time or AWS reports that the resource creation is complete (a false positive)

• provider/aws: iam_instance_profile not ready when TF creates the LaunchConfig of an ASG #2136
• aws_launch_configuration does not wait for aws_iam_instance_profile #2349
• Launch Configurations no longer properly wait for IAM Instance Profile propagation in v0.6.14 #5862

[vikas027]

Thanks for closing this one. I am on v0.9.6 now and not experiencing this anymore

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.