TF does not fail on inability to tag IAM Policy Resources with default tags

[mikecouk]

Sooooo ......

If you use default_tags in your AWS provider, and you also use an "aws_iam_user_policy" resource, then naturally your AWS IAM policy somewhere will have "iam:TagPolicy + iam:UntagPolicy" in it right ? Else the policy can't be tagged ....

However, if you DON'T have the those permissions in your policy, you'd expect terraform to bomb out. However it doesn't, it just carries on as normal, says "Modifications complete" and thinks it's all done. Further manual inspection of the AWS policy reveals the tags have not been applied, and if you re-run terraform it correctly notices the tags still haven't been applied yet, and will try again ... and again .... and again !

Summary : Terraform doesn't bomb out and report an error when it can't tag an IAM policy with default tags.

Terraform version = 1.2.0
hashicorp/aws version = 4.15
Other modules worked with = Datadog/datadog v 3.11.0

Thanks in advance people !

[justinretzolk]

Hey @mikecouk 👋 Thank you for taking the time to raise this! So that we have all of the necessary information in order to look into this, can you update the issue description to include all of the information requested in the bug report template?

[mikecouk]

@justinretzolk Hi Justin, unfortunately due to commercial reasons we cannot provide any more information or dedicate any more time to reporting this error. We do still believe though that you should be able to replicate this error with only the limited information we have provided, as it's quite a simple problem. Sorry we can't be of any more help.

[drmaciej]

FYI I'm observing he same behaviour.
I ran it with debug logging enabled, I saw a request failing with a 403, but terraform did indeed succeed.

[DrFaust92]

this is missing some info as aws_iam_user_policy is not taggable as its a resource to pair n IAM user with a policy (document)

[YakDriver]

Related #22532

[github-actions]

This functionality has been released in v4.20.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.