"terraform refresh" not picking up changes to policy text

[jgross206]

If a Terraform-managed policy is modified via Web console, the changes are not picked up on terraform refresh so they are not corrected on next terraform apply

Repro:

• create a new configuration with the following in policies.tf:

provider "aws" {
  # access_key and secret_key should be set using "aws configure"
  region = "us-west-2"
}

resource "aws_iam_policy" "test" {
  name  = "test-policy"
  description = "A test policy"
  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "glacier:ListVaults",
        "glacier:DescribeVault",
        "glacier:GetVaultNotifications",
        "glacier:ListJobs",
        "glacier:DescribeJob",
        "glacier:GetJobOutput"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}
EOF
}

• run terraform plan then terraform apply. The policy should be created.
• log in to the web console and modify the policy text, e.g. change "Allow" to "Deny"
• go back to the terminal and run terraform refresh
• Expected: the change should be noticed and updated into the state file. The next terraform apply should change the policy back to the one existing in our .tf file.
• Actual: no changes are detected. Subsequent terraform plan terraform apply succeed but the policy in AWS does not match the policy in source.

Happy to provide any more information needed.

[mroark1m]

I can confirm this issue, seeing the same thing.

[mattpminer]

I can confirm as well.

[jgross206]

In fact, this issue is even worse. If a "terraform apply" of a modified AWS policy fails

(e.g. with

• aws_iam_policy.datadog: Error updating IAM policy [REDACTED]: MalformedPolicyDocument: Syntax errors in policy.
  status code: 400, request id: [REDACTED]
  )

Then subsequent "terraform plan" will say "No changes. Infrastructure is up-to-date." even though the infrastructure is decidedly not up-to-date.

[Ehekatl]

confirm this problem as well
I have two s3 policy and one never change, but another one change every time as mentioned in #4948
how could it be...

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.