provider/aws: Deprecate roles in favour of role in iam_instance_profi…

…le (hashicorp#13130)

* provider/aws: Deprecate roles in favour of role in iam_instance_profile

You can only specify a single role to an IAM Instance Profile. So having
a slice of roles in the provider makes no sense. Therefore, we are going
to deprecate this infavour of `role`

```
% make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSIAMInstanceProfile_'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/03/28 21:24:20 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSIAMInstanceProfile_ -timeout 120m
=== RUN   TestAccAWSIAMInstanceProfile_importBasic
--- PASS: TestAccAWSIAMInstanceProfile_importBasic (25.08s)
=== RUN   TestAccAWSIAMInstanceProfile_basic
--- PASS: TestAccAWSIAMInstanceProfile_basic (22.40s)
=== RUN   TestAccAWSIAMInstanceProfile_withRoleNotRoles
--- PASS: TestAccAWSIAMInstanceProfile_withRoleNotRoles (22.63s)
=== RUN   TestAccAWSIAMInstanceProfile_missingRoleThrowsError
--- PASS: TestAccAWSIAMInstanceProfile_missingRoleThrowsError (4.02s)
=== RUN   TestAccAWSIAMInstanceProfile_namePrefix
--- PASS: TestAccAWSIAMInstanceProfile_namePrefix (22.18s)
PASS
ok  	github.com/hashicorp/terraform/builtin/providers/aws	96.349s
```

* Update iam_instance_profile.html.markdown

builtin/providers/aws/resource_aws_iam_instance_profile.go

@@ -86,10 +86,20 @@ func resourceAwsIamInstanceProfile() *schema.Resource {
 			},
 
 			"roles": {
-				Type:     schema.TypeSet,
-				Required: true,
-				Elem:     &schema.Schema{Type: schema.TypeString},
-				Set:      schema.HashString,
+				Type:          schema.TypeSet,
+				Optional:      true,
+				Computed:      true,
+				ConflictsWith: []string{"role"},
+				Elem:          &schema.Schema{Type: schema.TypeString},
+				Set:           schema.HashString,
+				Deprecated:    "Use `role` instead. Only a single role can be passed to an IAM Instance Profile",
+			},
+
+			"role": {
+				Type:          schema.TypeString,
+				Optional:      true,
+				Computed:      true,
+				ConflictsWith: []string{"roles"},
 			},
 		},
 	}
@@ -107,6 +117,13 @@ func resourceAwsIamInstanceProfileCreate(d *schema.ResourceData, meta interface{
 		name = resource.UniqueId()
 	}
 
+	_, hasRoles := d.GetOk("roles")
+	_, hasRole := d.GetOk("role")
+
+	if hasRole == false && hasRoles == false {
+		return fmt.Errorf("Either `roles` or `role` must be specified when creating an IAM Instance Profile")
+	}
+
 	request := &iam.CreateInstanceProfileInput{
 		InstanceProfileName: aws.String(name),
 		Path:                aws.String(d.Get("path").(string)),
@@ -132,7 +149,7 @@ func resourceAwsIamInstanceProfileCreate(d *schema.ResourceData, meta interface{
 		return fmt.Errorf("Timed out while waiting for instance profile %s: %s", name, err)
 	}
 
-	return instanceProfileSetRoles(d, iamconn)
+	return resourceAwsIamInstanceProfileUpdate(d, meta)
 }
 
 func instanceProfileAddRole(iamconn *iam.IAM, profileName, roleName string) error {
@@ -205,11 +222,35 @@ func instanceProfileRemoveAllRoles(d *schema.ResourceData, iamconn *iam.IAM) err
 func resourceAwsIamInstanceProfileUpdate(d *schema.ResourceData, meta interface{}) error {
 	iamconn := meta.(*AWSClient).iamconn
 
-	if !d.HasChange("roles") {
-		return nil
+	d.Partial(true)
+
+	if d.HasChange("role") {
+		oldRole, newRole := d.GetChange("role")
+
+		if oldRole.(string) != "" {
+			err := instanceProfileRemoveRole(iamconn, d.Id(), oldRole.(string))
+			if err != nil {
+				return fmt.Errorf("Error adding role %s to IAM instance profile %s: %s", oldRole.(string), d.Id(), err)
+			}
+		}
+
+		if newRole.(string) != "" {
+			err := instanceProfileAddRole(iamconn, d.Id(), newRole.(string))
+			if err != nil {
+				return fmt.Errorf("Error adding role %s to IAM instance profile %s: %s", newRole.(string), d.Id(), err)
+			}
+		}
+
+		d.SetPartial("role")
+	}
+
+	if d.HasChange("roles") {
+		return instanceProfileSetRoles(d, iamconn)
 	}
 
-	return instanceProfileSetRoles(d, iamconn)
+	d.Partial(false)
+
+	return nil
 }
 
 func resourceAwsIamInstanceProfileRead(d *schema.ResourceData, meta interface{}) error {
@@ -262,6 +303,10 @@ func instanceProfileReadResult(d *schema.ResourceData, result *iam.InstanceProfi
 	}
 	d.Set("unique_id", result.InstanceProfileId)
 
+	if result.Roles != nil && len(result.Roles) > 0 {
+		d.Set("role", result.Roles[0].RoleName) //there will only be 1 role returned
+	}
+
 	roles := &schema.Set{F: schema.HashString}
 	for _, role := range result.Roles {
 		roles.Add(*role.RoleName)

builtin/providers/aws/resource_aws_iam_instance_profile_test.go

@@ -2,6 +2,7 @@ package aws
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -37,13 +38,50 @@ func TestAccAWSIAMInstanceProfile_importBasic(t *testing.T) {
 }
 
 func TestAccAWSIAMInstanceProfile_basic(t *testing.T) {
+	var conf iam.GetInstanceProfileOutput
+
 	rName := acctest.RandString(5)
 	resource.Test(t, resource.TestCase{
 		PreCheck:  func() { testAccPreCheck(t) },
 		Providers: testAccProviders,
 		Steps: []resource.TestStep{
 			{
 				Config: testAccAwsIamInstanceProfileConfig(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSInstanceProfileExists("aws_iam_instance_profile.test", &conf),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSIAMInstanceProfile_withRoleNotRoles(t *testing.T) {
+	var conf iam.GetInstanceProfileOutput
+
+	rName := acctest.RandString(5)
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAWSInstanceProfileWithRoleSpecified(rName),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckAWSInstanceProfileExists("aws_iam_instance_profile.test", &conf),
+				),
+			},
+		},
+	})
+}
+
+func TestAccAWSIAMInstanceProfile_missingRoleThrowsError(t *testing.T) {
+	rName := acctest.RandString(5)
+	resource.Test(t, resource.TestCase{
+		PreCheck:  func() { testAccPreCheck(t) },
+		Providers: testAccProviders,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAwsIamInstanceProfileConfigMissingRole(rName),
+				ExpectError: regexp.MustCompile("Either `roles` or `role` must be specified when creating an IAM Instance Profile"),
 			},
 		},
 	})
@@ -157,6 +195,13 @@ resource "aws_iam_instance_profile" "test" {
 }`, rName)
 }
 
+func testAccAwsIamInstanceProfileConfigMissingRole(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_instance_profile" "test" {
+	name = "test-%s"
+}`, rName)
+}
+
 func testAccAWSInstanceProfilePrefixNameConfig(rName string) string {
 	return fmt.Sprintf(`
 resource "aws_iam_role" "test" {
@@ -169,3 +214,16 @@ resource "aws_iam_instance_profile" "test" {
 	roles = ["${aws_iam_role.test.name}"]
 }`, rName)
 }
+
+func testAccAWSInstanceProfileWithRoleSpecified(rName string) string {
+	return fmt.Sprintf(`
+resource "aws_iam_role" "test" {
+	name = "test-%s"
+	assume_role_policy = "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"ec2.amazonaws.com\"]},\"Action\":[\"sts:AssumeRole\"]}]}"
+}
+
+resource "aws_iam_instance_profile" "test" {
+	name_prefix = "test-"
+	role = "${aws_iam_role.test.name}"
+}`, rName)
+}

website/source/docs/providers/aws/r/iam_instance_profile.html.markdown

@@ -10,6 +10,8 @@ description: |-
 
 Provides an IAM instance profile.
 
+~> **NOTE:** Either `roles` or `role` must be specified in the IAM Instance Profile.
+
 ## Example Usage
 
 ```
@@ -47,7 +49,8 @@ The following arguments are supported:
 * `name` - (Optional, Forces new resource) The profile's name. If omitted, Terraform will assign a random, unique name.
 * `name_prefix` - (Optional, Forces new resource) Creates a unique name beginning with the specified prefix. Conflicts with `name`.
 * `path` - (Optional, default "/") Path in which to create the profile.
-* `roles` - (Required) A list of role names to include in the profile.  The current default is 1.  If you see an error message similar to `Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1`, then you must contact AWS support and ask for a limit increase.
+* `roles` - (Optional) A list of role names to include in the profile.  The current default is 1.  If you see an error message similar to `Cannot exceed quota for InstanceSessionsPerInstanceProfile: 1`, then you must contact AWS support and ask for a limit increase. `WARNING: This will be deprecated in a future version of Terraform`.
+* `role` - (Optional) The role name to include in the profile. This.
 
 ## Attribute Reference
 
@@ -57,6 +60,7 @@ The following arguments are supported:
 * `name` - The instance profile's name.
 * `path` - The path of the instance profile in IAM.
 * `roles` - The list of roles assigned to the instance profile.
+* `role` - The role assigned to the instance profile
 * `unique_id` - The [unique ID][1] assigned by AWS.
 
   [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#GUIDs