How to escape HCL string containing ${aws:username} in "Resource" section?

Question

How to escape HCL string containing ${aws:username} in "Resource" section?

I currently use Terraform version 0.9.9 to create AWS policies in a main.tf file in following way:

resource "aws_iam_group_policy" "AllowIndividualUserToSeeTheirAccountInformation" {
      name  = "AllowIndividualUserToSeeTheirAccountInformation"
      group = "${aws_iam_group.pr_faas_developers.id}"

      policy = <<EOF
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }
    EOF
    }

When doing so, Terraform tries to interpolate ${aws:username} and terraform is going to fail as follows

terraform.exe plan
Failed to load root config module: Error loading D:\amazonaws-root-master\main.t
f: Error reading config for aws_iam_group_policy[AllowIndividualUserToSeeTheirAc
countInformation]: parse error at 17:51: expected "}" but found ":"

When I'm escaping the resource string as follows:

"Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws\\:username\\}"
        ]

"terraform plan" and "terraform apply" is going to work fine but the result within AWS show policy is:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
            "iam:ChangePassword",
            "iam:CreateLoginProfile",
            "iam:DeleteLoginProfile",
            "iam:GetAccountPasswordPolicy",
            "iam:GetAccountSummary",
            "iam:GetLoginProfile",
            "iam:UpdateLoginProfile"
      ],
      "Effect": "Allow",
      "Resource":
      [
            "arn:aws:iam::XXXXXXXXX:user/\\$\\{aws:username\\}"
        ]

    }
  ]
}

which is different from the expected outcome:

 {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Action": [
                "iam:ChangePassword",
                "iam:CreateLoginProfile",
                "iam:DeleteLoginProfile",
                "iam:GetAccountPasswordPolicy",
                "iam:GetAccountSummary",
                "iam:GetLoginProfile",
                "iam:UpdateLoginProfile"
          ],
          "Effect": "Allow",
          "Resource":
          [
                "arn:aws:iam::XXXXXXXXX:user/${aws:username}"
            ]

        }
      ]
    }

Is there any solution to escape "arn:aws:iam::XXXXXXXXX:user/${aws:username}" within the terraform main.tf file for the desired outcome?

Answer 1

you can fix it by double dollar $$

refer:

terraform interpolation

You can escape interpolation with double dollar signs: $${foo} will be rendered as a literal ${foo}.

https://github.com/hashicorp/terraform/issues/2965

Answer 2

Recently running into similar string literal issue, copy the response into here to help more folks.

Note, this still applies with Terraform 0.12.

"In both quoted and heredoc string expressions, Terraform supports template sequences that begin with ${ and %{."

"To include these sequences literally without beginning a template sequence, double the leading character: $${ or %%{."

Please have a look at the docs for more details.