Create a method for to convert list into str

[ssala7]

s3_role.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "sts:AssumeRole",
      "Principal": {
        "Service":
          "${iam_s3_role_principal}"
      },
      "Effect": "Allow",
      "Sid": ""
    }
  ]
}

variable "iam_s3_role_principal" {
  type = "list"
  default = ["ec2.amazonaws.com","ecs.amazonaws.com"]
}

data "template_file" "iam_s3_role" {
  template = "${file("${path.module}/s3_role.json")}"
  vars {
    iam_s3_role_principal = "${jsonencode(var.iam_s3_role_principal)}"
  }
}

resource "aws_iam_role" "s3_role" {
  name               = "${var.service}_${var.project}_role"
  assume_role_policy = "${data.template_file.iam_s3_role.rendered}"
}

Error:

I have used jsonencode got error: "assume_role_policy" contains an invalid JSON: invalid character 'e' after object key:value pair

  vars {
    iam_s3_role_principal = "${**str(var.iam_s3_role_principal)**}"
  }

Error:

unknown function called: str in:

Create a function for str so we can convert anything into a string.

[apparentlymart]

Hi @ssala7!

We have a few functions that can turn lists into strings, which looks like what you need to do here. Which function you'd use depends on what format you need the resulting string to be in:

• join will simply concatenate the list elements together with a delimiter you specify; this is the simplest
• jsonencode will turn the list into string containing a JSON array.

In this case it seems like jsonencode is what you need, since the IAM policy document is in JSON format. An alternative is to use the aws_iam_policy_document data source, which behaves like a more specialized template that understands IAM policy syntax natively:

data "aws_iam_policy_document" "s3_role_assume" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRole"]
    principals {
      type        = "Service"
      identifiers = "${var.iam_s3_role_principal}"
    }
  }
}

resource "aws_iam_role" "s3_role" {
  name               = "${var.service}_${var.project}_role"
  assume_role_policy = "${data.aws_iam_policy_document.s3_role_assume.json}"
}

This approach avoids the need for any explicit conversion of the list to string, since the identifiers argument in the principals block expects a list and does the conversion to JSON internally.

[apparentlymart]

Hi again @ssala7!

Since I didn't hear back from you I'm going to hope that my previous response gave you what you needed here, and close this out.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.