'How to escape HCL string containing ${aws:username} in "Resource" section?

How to escape HCL string containing ${aws:username} in "Resource" section?

I currently use Terraform version 0.9.9 to create AWS policies in a main.tf file in following way:

resource "aws_iam_group_policy" "AllowIndividualUserToSeeTheirAccountInformation" {
      name  = "AllowIndividualUserToSeeTheirAccountInformation"
      group = "${aws_iam_group.pr_faas_developers.id}"

      policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }
    EOF
    }

When doing so, Terraform tries to interpolate ${aws:username} and terraform is going to fail as follows

terraform.exe plan
Failed to load root config module: Error loading D:\amazonaws-root-master\main.t
f: Error reading config for aws_iam_group_policy[AllowIndividualUserToSeeTheirAc
countInformation]: parse error at 17:51: expected "}" but found ":"

When I'm escaping the resource string as follows:

"Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws\\:username\\}"
        ]

"terraform plan" and "terraform apply" is going to work fine but the result within AWS show policy is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
            "iam:ChangePassword",
            "iam:CreateLoginProfile",
            "iam:DeleteLoginProfile",
            "iam:GetAccountPasswordPolicy",
            "iam:GetAccountSummary",
            "iam:GetLoginProfile",
            "iam:UpdateLoginProfile"
      ],
      "Effect": "Allow",
      "Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws:username\\}"
        ]

    }
  ]
}

which is different from the expected outcome:

 {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }

Is there any solution to escape "arn:aws:iam::XXXXXXXXX:user/${aws:username}" within the terraform main.tf file for the desired outcome?

terraform

Solution 1:^[1]

Recently running into similar string literal issue, copy the response into here to help more folks.

Note, this still applies with Terraform 0.12.

"In both quoted and heredoc string expressions, Terraform supports template sequences that begin with ${ and %{."

"To include these sequences literally without beginning a template sequence, double the leading character: $${ or %%{."

Please have a look at the docs for more details.

Solution 2:^[2]

https://registry.terraform.io/providers/hashicorp/aws/2.69.0/docs/data-sources/iam_policy_document#context-variable-interpolation

The IAM policy document format allows context variables to be interpolated into various strings within a statement. The native IAM policy document format uses ${...}-style syntax that is in conflict with Terraform's interpolation syntax, so this data source instead uses &{...} syntax for interpolations that should be processed by AWS rather than by Terraform.

so you can do

    resources = [
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}",
      "arn:aws:s3:::${var.s3_bucket_name}/home/&{aws:username}/*",
    ]

Solution 3:^[3]

There are 2 solutions:

Escape that variable in shell script using an extra $ before it. For example, PROJECT=$${project}
Add that variable as project = "$project" under the list of variables for file in terraform script and it will replace ${project} with $project and the script will still work.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution	Source
Solution 1	Community
Solution 2	Henry Finucane
Solution 3	Abdullah Khawer

'How to escape HCL string containing ${aws:username} in "Resource" section?

Solution 1:[1]

Solution 2:[2]

Solution 3:[3]

Sources

Related Questions

Solution 1:^[1]

Solution 2:^[2]

Solution 3:^[3]