Fixing Terraform IAM Roles After managed_policy_arns Deprecation
As of recent updates in the Terraform AWS Provider, the widely used managed_policy_arns argument in the aws_iam_role resource is officially deprecated. This change has affected many infrastructure-as-code workflows, requiring teams to refactor their Terraform configurations to align with the new structure.
This guide will walk through the deprecation, what it means, and how to fix your Terraform code to comply with the updated best practices.
Understanding the Deprecation
The managed_policy_arns attribute was a convenient way to attach multiple managed IAM policies directly to an aws_iam_role. However, to improve flexibility and reduce confusion in resource handling, the Terraform AWS provider recommends explicitly attaching policies using the aws_iam_role_policy_attachment resource.
Why the Change?
Granular Control: Encourages the separation of concerns and gives finer control over policy attachment lifecycle.
Better Plan Visibility: Changes in policy attachment are visible in the plan output, as they are now separate resources.
Consistency with AWS API: Aligns more closely with how IAM roles and policies are managed in AWS natively.
Fixing the Issue in Your Terraform Code
Old (Deprecated) Method
resource "aws_iam_role" "example" {
name = "example-role"
assume_role_policy = data.aws_iam_policy_document.assume_role.json
managed_policy_arns = [
"arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess",
"arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
]
}
New (Recommended) Method
resource "aws_iam_role" "example" {
name = "example-role"
assume_role_policy = data.aws_iam_policy_document.assume_role.json
}
resource "aws_iam_role_policy_attachment" "s3_readonly" {
role = aws_iam_role.example.name
policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
}
resource "aws_iam_role_policy_attachment" "cw_logs_full" {
role = aws_iam_role.example.name
policy_arn = "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
}
Terraform Workflow
Remove the managed_policy_arns block from aws_iam_role.
Add a corresponding aws_iam_role_policy_attachment for each managed policy.
Run terraform plan to verify changes.
Apply with terraform apply to reflect the updates.
Tips and Best Practices
Use explicit naming for each aws_iam_role_policy_attachment to improve readability and maintainability.
Leverage Terraform modules if your policy attachments follow reusable patterns.
Ensure your state file is clean by avoiding drift caused by deprecated arguments.
Final Thoughts
Terraform’s deprecation of managed_policy_arns may initially seem like a nuisance, but it’s a step toward better modularization and policy management. Adapting to the new approach gives you more control and transparency in your IAM role configurations.
Audit all IAM role resources in your codebase and apply the recommended changes to avoid future provider errors or unexpected behaviors.
Comments
Post a Comment