From d1c161a23b040de4a0ef6679efe99dd000d61f5e Mon Sep 17 00:00:00 2001 From: Dave Arnold Date: Thu, 23 Jul 2026 13:20:31 -0400 Subject: [PATCH] fix: use static ARNs in attached_policies to avoid for_each unknown value error Terraform cannot use compute-time resource ARNs (aws_iam_policy.*.arn) as for_each set keys since they are unknown at plan time. Replace with statically constructed ARNs using locals that are always known at plan time: format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.) Fixes 'Invalid for_each argument' errors on all three role modules. --- roles.tf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/roles.tf b/roles.tf index ed2f6c5..836cebd 100644 --- a/roles.tf +++ b/roles.tf @@ -5,7 +5,7 @@ module "patch_role" { role_name = local.patch_role_name role_description = format("Assumed by %v to execute patching operations on EC2 instances in target accounts", local.patch_execution_role_name) assume_policy_document = data.aws_iam_policy_document.patch_role_assume.json - attached_policies = [aws_iam_policy.patch_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_policy_name)] tags = local.tags_iam } @@ -17,7 +17,7 @@ module "patch_execution_role" { role_name = local.patch_execution_role_name role_description = format("Assumed by Lambda functions to invoke patch operations, access SQS/RDS, and assume %v in target accounts", local.patch_role_name) assume_policy_document = data.aws_iam_policy_document.patch_execution_role_assume.json - attached_policies = [aws_iam_policy.patch_execution_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execution_policy_name)] tags = local.tags_iam } @@ -31,7 +31,7 @@ module "patch_execproxy_role" { role_name = local.patch_execproxy_role_name role_description = format("Applied to the EC2 host running p4proxy; allows RDS IAM auth and assumption of %v", local.patch_execution_role_name) assume_policy_document = data.aws_iam_policy_document.patch_execproxy_role_assume.json - attached_policies = [aws_iam_policy.patch_execproxy_role.arn] + attached_policies = [format("arn:%v:iam::%v:policy/%v", local.partition, local.account_id, local.patch_execproxy_policy_name)] enable_instance_profile = true tags = local.tags_iam