Closed
Description
I think I'm seeing a race condition when using instance profiles.
In this case there were 5 instances (foo.0, foo.1, bar.0, bar.1, bar.2) that all use the same InstanceProfile. Two of them work fine but three of them claim the instance profile has no role associated:
aws_route_table_association.testing: Creation complete
aws_instance.bar.1: Error: 1 error(s) occurred:
* Error launching source instance: InvalidParameterValue: IAM Instance Profile "arn:aws:iam::123123:instance-profile/test_bucket_access_instance_profile" has no associated IAM Roles
status code: 400, request id: []
aws_instance.bar.2: Error: 1 error(s) occurred:
* Error launching source instance: InvalidParameterValue: IAM Instance Profile "arn:aws:iam::123123:instance-profile/test_bucket_access_instance_profile" has no associated IAM Roles
status code: 400, request id: []
aws_instance.foo.0: Error: 1 error(s) occurred:
* Error launching source instance: InvalidParameterValue: IAM Instance Profile "arn:aws:iam::123123:instance-profile/test_bucket_access_instance_profile" has no associated IAM Roles
status code: 400, request id: []
aws_instance.bar.0: Provisioning with 'file'...
aws_instance.foo.1: Provisioning with 'file'...
I'm wondering if this is an eventual consistency issue and this particular error launching should just include some retry logic. Obviously the InstanceProfile does have a Role since it works for some of the instances.
This is not repeatable regularly and just applying again gets me my missing instances.
A slightly redacted portion of the config:
{
resource "aws_instance" "foo" {
ami = "${var.baseAMI}"
instance_type = "${var.fooInstanceType}"
count = "${var.numFooInstances}"
key_name = "${var.keyName}"
subnet_id = "${aws_subnet.foo.id}"
vpc_security_group_ids = ["${aws_security_group.default.id}", "${aws_security_group.ssh.id}"]
tags {
Name = "${format("foo-%d", count.index)}"
}
iam_instance_profile = "${aws_iam_instance_profile.test_bucket_access_instance_profile.name}"
root_block_device {
delete_on_termination=true
}
provisioner "file" {
connection {
key_file = "${var.sshKeyFilename}"
user = "${var.amiUsername}"
}
source = "mystuff"
destination = "/home/${var.amiUsername}/mystuff"
}
}
resource "aws_iam_instance_profile" "test_bucket_access_instance_profile" {
name = "test_bucket_access_instance_profile"
roles = ["${aws_iam_role.test_bucket_access_role.name}"]
}
resource "aws_iam_role" "test_bucket_access_role" {
name = "test_bucket_access_role"
assume_role_policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
EOF
}
resource "aws_iam_role_policy" "test_bucket_access_policy" {
name = "test_bucket_access_policy"
role = "${aws_iam_role.test_bucket_access_role.id}"
policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::${var.s3BucketName}"
},
{
"Effect": "Allow",
"Action": "s3:*",
"Resource": "arn:aws:s3:::${var.s3BucketName}/*"
}
]
}
EOF
}