IAM intstance profile issue

[Bubunia Patra]

Hi all,

I am struggling to find out the reason why the terraform(Terraform v0.9.11) complains and fails with the following reason when after running "terraform destroy" and "terraform apply" again. The IAM roles that are recreated dont get cleaned up and raises a error message as below.  Is it fixed in latest version of terraform or needs to be removed manually using AWS CLI?

https://github.com/hashicorp/terraform/issues/4131  

Error creating IAM instance profile test-iam-instance-profile-ec2-test: EntityAlreadyExists: Instance Profile test-iam-instance-profile-ec2-test already exists.

Regards

Pradeep 

[⁞ Fernando Miguel]

You probably created a previous ec2 instance profile and never deleted it, and are trying to reuse the name. 

Delete it manually via aws cli and it will work again 

--
Fernando Miguel

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/terraform/issues
IRC: #terraform-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Terraform" group.
To unsubscribe from this group and stop receiving emails from it, send an email to terraform-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/849b3b06-7104-4aaa-b9c0-8b8457112a18%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Bubunia Patra]

Actually the problem is there terraform destroy should clean up the instance provided created by terraform. But it doesnt .
 Not sure the latest version exists or not.

On Friday, March 9, 2018 at 12:23:46 AM UTC+8, Fernando wrote:

You probably created a previous ec2 instance profile and never deleted it, and are trying to reuse the name. 

Delete it manually via aws cli and it will work again 

--
Fernando Miguel

On 8 Mar 2018 16:21, "Bubunia Patra" <bubunia...@gmail.com> wrote:

Hi all,

I am struggling to find out the reason why the terraform(Terraform v0.9.11) complains and fails with the following reason when after running "terraform destroy" and "terraform apply" again. The IAM roles that are recreated dont get cleaned up and raises a error message as below.  Is it fixed in latest version of terraform or needs to be removed manually using AWS CLI?

https://github.com/hashicorp/terraform/issues/4131  

Error creating IAM instance profile test-iam-instance-profile-ec2-test: EntityAlreadyExists: Instance Profile test-iam-instance-profile-ec2-test already exists.

Regards

Pradeep 

--
This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/terraform/issues
IRC: #terraform-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Terraform" group.

To unsubscribe from this group and stop receiving emails from it, send an email to terraform-too...@googlegroups.com.

[⁞ Fernando Miguel]

i cant say i ever had that problem with any aws provider 0.10 or 0.11

-- 

Fernando Miguel

https://FernandoMiguel.net

To unsubscribe from this group and stop receiving emails from it, send an email to terraform-tool+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/cd05b7bb-130a-4f04-aa26-3de759083767%40googlegroups.com.

[Clint Shryock]

Hello!

>Actually the problem is there terraform destroy should clean up the instance provided created by terraform. But it doesnt .

Can you verify the cleanup for us? If you could, please provide the `terraform destroy` output (omitting any secrets!) and then verify in the web console that the profile is in fact destroyed. IAM is notorious for eventual consistency issues. If you're destroying and then re-creating fairly quickly, then this could be the case and we can add some retry code to the create method and / or verification to the delete method.

Thanks!

Clint

To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/CAM7yfUBPJXb5a37jAU_uPXCB0gmYyboQYqgTAr7BevRCUN7dMw%40mail.gmail.com.

[André R. Agostinho]

I had the same problem. 

Even investigating on AWS and manually removing IAM Roles the problem continue happening.

I my case I created many EC2s before using the same IAM Role in .tf files, like Fernando said here.

I solved the problem omitting Name attribute for IAM Role, IAM Policy and IAM Profile.  When you ommit the attribute Name Terraform will gen a random name for it.

resource "aws_iam_role_policy" "terraformIamPolicy" { 

  role = "${aws_iam_role.terraformIamRole.id}"

  policy = "${file("policies/iamrolepolicy.json")}" 

} 

resource "aws_iam_role" "terraformIamRole" {

  assume_role_policy = "${file("policies/assumerolepolicy.json")}"  

  tags = {

      Name = "terraformIamRole"

  }

} 

resource "aws_iam_instance_profile" "terraformProfile" {  

  role = "${aws_iam_role.terraformIamRole.name}"

}

resource "aws_instance" "helloTerraForm" {

  instance_type = "t2.large"

  ami           = "ami-0401b579fa08f00fb"

  count         = 1  

  iam_instance_profile = "${aws_iam_instance_profile.terraformProfile.name}"  

} 

 

The result will be something like that "terraform-10190512212708041200000001"

[Chamila de Alwis]

Confirming that I've also consistently being seeing this behavior with multiple Terraform versions. As far as I could find out, this behavior was because of [1]. My solution was somewhat similar to Andre's where I suffixed the IAM profile name with a random string.

[1] - https://github.com/hashicorp/terraform/issues/3749

Regards,

Chamila de Alwis

Committer and PMC Member - Apache Stratos

Blog: medium.com/@chamilad

--

This mailing list is governed under the HashiCorp Community Guidelines - https://www.hashicorp.com/community-guidelines.html. Behavior in violation of those guidelines may result in your removal from this mailing list.
 
GitHub Issues: https://github.com/hashicorp/terraform/issues
IRC: #terraform-tool on Freenode
---
You received this message because you are subscribed to the Google Groups "Terraform" group.
To unsubscribe from this group and stop receiving emails from it, send an email to terraform-too...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/terraform-tool/e7cabe59-010e-44ed-bd53-273922c3512b%40googlegroups.com.