r/aws_iam_role_policy_attachments_exclusive: new resource

[jar-b]

Description

This resource will allow practitioners to retain exclusive ownership of customer managed policy attachments to IAM roles via Terraform.

Relations

Relates #39376
Closes #39379

References

• https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachRolePolicy.html
• https://docs.aws.amazon.com/IAM/latest/APIReference/API_DetachRolePolicy.html

Output from Acceptance Testing

% make testacc PKG=iam TESTS=TestAccIAMRolePolicyAttachmentsExclusive_
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.2 test ./internal/service/iam/... -v -count 1 -parallel 20 -run='TestAccIAMRolePolicyAttachmentsExclusive_'  -timeout 360m
2024/10/14 15:25:06 Initializing Terraform AWS Provider...

--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_empty (16.00s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_disappears_Policy (17.99s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_disappears_Role (18.13s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_basic (18.24s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition (26.34s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandRemoval (26.48s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_multiple (26.84s)
PASS
ok      github.com/hashicorp/terraform-provider-aws/internal/service/iam        33.206s

[github-actions]

Community Note

Voting for Prioritization

• Please vote on this pull request by adding a 👍 reaction to the original post to help the community and maintainers prioritize this pull request.
• Please see our prioritization guide for information on how we prioritize.
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.

For Submitters

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccIAMRolePolicyAttachmentsExclusive_' PKG=iam ACCTEST_PARALLELISM=3
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.23.2 test ./internal/service/iam/... -v -count 1 -parallel 3  -run=TestAccIAMRolePolicyAttachmentsExclusive_ -timeout 360m
2024/10/15 09:24:25 Initializing Terraform AWS Provider...
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_basic
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_basic
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_disappears_Role
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_disappears_Role
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_disappears_Policy
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_disappears_Policy
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_multiple
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_multiple
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_empty
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_empty
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_outOfBandRemoval
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_outOfBandRemoval
=== RUN   TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition
=== PAUSE TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_basic
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_empty
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_disappears_Policy
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_empty (11.22s)
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_disappears_Role
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_disappears_Policy (11.44s)
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_basic (13.03s)
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_multiple
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_disappears_Role (10.80s)
=== CONT  TestAccIAMRolePolicyAttachmentsExclusive_outOfBandRemoval
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition (17.81s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_multiple (19.86s)
--- PASS: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandRemoval (18.22s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/iam	45.200s

The first time I ran the tests I saw an error:

=== NAME  TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition
    role_policy_attachments_exclusive_test.go:260: Step 2/2 error: Error running apply: exit status 1
        
        Error: deleting IAM Policy (arn:aws:iam::187416307283:policy/tf-testing/tf-acc-test-2996109381719547812-out-of-band): operation error IAM: DeletePolicy, https response error StatusCode: 409, RequestID: de36e887-b4e3-4d33-ab8e-71b4913c9c5b, DeleteConflict: Cannot delete a policy attached to entities.
        
--- FAIL: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition (13.69s)

which suggests a retry may be necessary.

[jar-b]

The first time I ran the tests I saw an error:

=== NAME TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition
role_policy_attachments_exclusive_test.go:260: Step 2/2 error: Error running apply: exit status 1

    Error: deleting IAM Policy (arn:aws:iam::187416307283:policy/tf-testing/tf-acc-test-2996109381719547812-out-of-band): operation error IAM: DeletePolicy, https response error StatusCode: 409, RequestID: de36e887-b4e3-4d33-ab8e-71b4913c9c5b, DeleteConflict: Cannot delete a policy attached to entities.

--- FAIL: TestAccIAMRolePolicyAttachmentsExclusive_outOfBandAddition (13.69s)

which suggests a retry may be necessary.

Apologies, missed this part of the review comment earlier. This is a bug in the test case I missed when refactoring (the configuration switches between steps when it should not). I'll open a follow up PR.

[github-actions]

This functionality has been released in v5.72.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!