Unable to create Kinesis Analytics application: InvalidArgumentException

[stephencoe]

This is the same problem as listed in #7032 with the exception that it is being raised when a kinesis_firehose is used as an input.

Terraform Version

Terraform v0.11.11
+ provider.aws v1.56.0

Affected Resource(s)

• aws_kinesis_analytics_application

Terraform Configuration Files

resource "aws_kinesis_firehose_delivery_stream" "firehose_stream" {
  name        = "${local.firehose_stream_name}"
  ..
}

data "aws_iam_policy_document" "kinesis_analytics" {
  statement {
    actions = [
      "firehose:DescribeDeliveryStream",
      "firehose:Get*",
    ]

    resources = [
      "${aws_kinesis_firehose_delivery_stream.firehose_stream.arn}"
    ]
  }
}

resource "aws_kinesis_analytics_application" "test" {
  name = "example"

  inputs {
    kinesis_firehose {
      resource_arn = "${aws_kinesis_firehose_delivery_stream.firehose_stream.arn}"
      role_arn     = "${module.kinesis_analytics_role.role_arn}"
    }
    ..
  }
}

Debug Output

aws_kinesis_analytics_application.logs: Unable to create Kinesis Analytics application: InvalidArgumentException: Kinesis Analytics doesn't have sufficient privileges to the Delivery Stream using assumed role. Please check the DeliveryStreamARN: 'arn:aws:firehose:eu-west-1:00000000:deliverystream/test_stream' and the roleARN: 'arn:aws:iam::00000000:role/kinesis_analytics_test'.

Expected Behavior

Creation without errors

Actual Behavior

Creation of Kinesis Application gets failed after the first execution. When I apply the same scripts second time - everyting gets created.

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[bflad]

The fix for this has been merged and will release with version 1.60.0 of the Terraform AWS Provider, shortly.

[bflad]

This has been released in version 1.60.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!