Terraform: Error creating IAM Role. MalformedPolicyDocument: Has prohibited field Resource

Question

My TF code is giving me an error:

  /*
   * Policy: AmazonEC2ReadOnlyAccess
   */
  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ec2:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "elasticloadbalancing:Describe*",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:ListMetrics",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "autoscaling:Describe*",
            "Resource": "*"
        }
    ]
}
EOF

I copied and pasted the Policy from https://console.aws.amazon.com/iam/home?region=us-west-2#/policies/arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess$jsonEditor

* aws_iam_role.<role name>: Error creating IAM Role <role name>: MalformedPolicyDocument: Has prohibited field Resource
status code: 400, request id: <request id>

Not sure why it's saying Resource is prohibited.

Answer 1

• Need to define assume_role_policy with sts:AssumeRole (Who can assume this role, ex: EC2 service).

• Policy can be directly attached using aws_iam_role_policy_attachment instead of duplicating existing policy.

  resource "aws_iam_role" "ec2_iam_role" {
    name = "ec2_iam_role"
    assume_role_policy = <<EOF
  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Service": [
            "ec2.amazonaws.com"
          ]
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }
  EOF
  }
  
  resource "aws_iam_role_policy_attachment" "ec2-read-only-policy-attachment" {
      role = "${aws_iam_role.ec2_iam_role.name}"
      policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
  }