Description
Description
When creating a totally custom SNS policy using a terraform aws_iam_policy_document as the topic_policy value, terraform throws a Error: Cycle Error if the module output of the module the policy is being attached to is referenced in the SNS topics policy.
The policy works fine if I remove the module reference and hardcode the ARN, however since this behaviour works in other Terraform modules for example https://github.com/terraform-aws-modules/terraform-aws-s3-bucket I figured it would work in this one
Versions
-
Module version [Required]: 6.0.1
-
Terraform version: v1.5.7
- Provider version(s):
- registry.terraform.io/hashicorp/aws v5.43.0
Reproduction Code [Required]
data "aws_iam_policy_document" "sns_policy" {
statement {
sid = "sub"
effect = "Allow"
resources = [
"${module.sns.topic_arn}/*",
]
actions = [
"sns:Subscribe"
]
principals {
type = "AWS"
identifiers = ["*"]
}
}
}
module "sns" {
source = "terraform-aws-modules/sns/aws"
name = "bug-report-sns-topic"
create_topic_policy = false
topic_policy = data.aws_iam_policy_document.sns_policy.json
}
Steps to reproduce the behaviour:
- run
terraform init - run
terraform validate
Expected behavior
The validation should pass with no errors.
Actual behavior
The validation fails with the following error:
╷
│ Error: Cycle: module.sns.output.topic_arn (expand), data.aws_iam_policy_document.sns_policy, module.sns.var.topic_policy (expand), module.sns.aws_sns_topic.this
│
│
╵
Terminal Output Screenshot(s)
Additional context
I've done similar things with terraform modules for example https://github.com/terraform-aws-modules/terraform-aws-s3-bucket where doing the following:
data "aws_iam_policy_document" "bucket_policy" {
statement {
sid = "AllowReadWriteAccess"
effect = "Allow"
resources = [
module.s3.s3_bucket_arn,
"${module.s3.s3_bucket_arn}/*"
]
principals {
type = "AWS"
identifiers = ["*"]
}
actions = [
"s3:List*",
"s3:Get*",
"s3:DeleteObject"
]
}
}
module "s3" {
source = "terraform-aws-modules/s3-bucket/aws"
bucket = "s3-bucket"
attach_policy = true
policy = data.aws_iam_policy_document.bucket_policy.json
}