-
Notifications
You must be signed in to change notification settings - Fork 9.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
IAM instance profile <name> EntityAlreadyExists, but it actually didn't. #12121
Comments
I don't think this is a provider issue. Everything that was supposed to happen in aws happened correctly. The problem was with Terraform persisting this data to its state which is NOT handled in the aws provider. |
I encountered the same error. But the actual problem is this.
.... Error: Error creating IAM instance profile k8s-master: EntityAlreadyExists: Instance Profile k8s-master already exists. on iam.tf line 133, in resource "aws_iam_instance_profile" "k8s-master": Error: Error creating IAM instance profile k8s-node: EntityAlreadyExists: Instance Profile k8s-node already exists. on iam.tf line 138, in resource "aws_iam_instance_profile" "k8s-node": resource "aws_iam_role" "k8s_master_role" { assume_role_policy = <<-EOF resource "aws_iam_role_policy" "k8s_master" { resource "aws_iam_instance_profile" "k8s-master" { The same problem occurs in the above configuration. olny change aws_iam_instance_profile name. As long as it is different from aws_iam_role name. name = "k8s-master" to name = "k8s-master-profile" , the problem resolve. |
I encountered this problem with aws_iam_role. Seems to be like we most likely hit some sort of timeout. If the timeout is hit, we retry creating the role one last time. I suspect I hit it on that timeout. https://github.com/terraform-providers/terraform-provider-aws/blob/98b5f7be6cd1ebca2bd5749135e0bd0c305418c1/aws/resource_aws_iam_role.go#L170 |
Hi all 👋 Thank you for taking the time to file this issue, and for the continued discussion! Given that there's been a number of AWS provider releases since this was filed, is anyone still encountering this behavior? |
I still run into this as of 3.68.0 with
The role doesn't actually exist. Running the plan again shows adding all the missing resources. Apply works fine of course. For me, this is 100% repeatable. It happens every time in my testing. |
I am having this issue with hashicorp/aws v4.8.0. Terrafor version 1.1.7 Error: failed creating IAM Role (vpc-flow-logs-main.us-east-1): EntityAlreadyExists: Role with name vpc-flow-logs-main.us-east-1 already exists. Error: error creating IAM Policy main_flow_logs_policy.us-east-1: EntityAlreadyExists: A policy called main_flow_logs_policy.us-east-1 already exists. Duplicate names are not allowed. Please advise how to persisting terraform data into its state? |
I'm also running into this issue on |
What I noticed with the
After removing this and adding the
|
As maintainers of the Terraform AWS Provider, we’ve reached a decision to close this longstanding issue. We want to assure you that this decision was made after careful consideration, and we’re committed to transparency in our actions. At this time, I cannot reproduce the issue which may or may not mean it has been fixed in the interim. We lack clarity on how many users are still affected and the precise nature of the remaining issues. Given these uncertainties and our limited resources, it’s difficult for us to effectively address the problem in its current state. However, we value community feedback immensely. If you’re still encountering issues, we encourage you to open a new, focused issue outlining the specific problems you’re facing. We especially need a minimal reproduction configuration. We understand the frustration of having to restart the discussion, but the long history of this particular issue necessitates a fresh approach. While we’ve received reports from community members in the past year, these are no directly related to continuing problems. Moving forward, a new, well-defined problem statement will greatly increase the likelihood of prompt attention from maintainers or fellow community members. Ultimately, our goal is to ensure that the Terraform AWS Provider remains a dependable tool for realizing your infrastructure goals. Regrettably, this prolonged issue no longer contributes to that objective. By closing it, we aim to clear the path for more effective problem-solving and a smoother experience for all users. We appreciate your understanding and continued support as we work towards a better future for your provider. |
Warning This issue has been closed, meaning that any additional comments are hard for our team to see. Please assume that the maintainers will not see them. Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed. |
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. |
This issue was originally opened by @dpedu as hashicorp/terraform#24177. It was migrated here as a result of the provider split. The original body of the issue is below.
Terraform Version
Terraform Configuration Files
Debug Output
I suspect this is a timing issue and I was not running Terraform with TF_LOG at the time. Because of changes made to the platform account I was using terraform under, I can't attempt to reproduce this.
Expected Behavior
Terraform successfully persists resources it created to state.
Actual Behavior
Terraform outputs
Error creating IAM instance profile [profile name]: EntityAlreadyExists: Instance Profile [profile name] already exists.
because it created the resource but did not persist it to its state.Steps to Reproduce
Additional Context
I was running this code on 5 separate hosts in parallel with different parameters that would prevent intentional collisions due to naming. The outcome of each is described below. The numbers don't indicate execution order.
Each apply was creating an AWS VPC along with other stuff (roles, permissions, dns, etc). AWS limits accounts to 10 VPCs by default, trying to create more results in an error.
EntityAlreadyExists
.EntityAlreadyExists
.EntityAlreadyExists
.For each with an
EntityAlreadyExists
I manually check the state file and AWS. In all cases, the resource had been created in AWS but was missing from the state file.Looking at an instance that hit problem 2, 3, or 4 above shows the following series of events:
terraform plan -out somefile
terraform apply somefile
module.vpc_common.module.role_provisioning.aws_iam_role.cfnprovision: Creation complete after 1s [id=role-name-censored]
.terraform apply
(no plan file this time) hits theEntityAlreadyExists
error. Here is the exact error mentioning the role name printed in the previous execution:This looks and smells like the resource already existed prior to using Terraform. I am confident that this is not the case.
I was unable to workaround this issue by importing the orphaned resource due to #8040.
The text was updated successfully, but these errors were encountered: