Racing condition of IAM role creation and AWS resources

Question

Customer who is using Terraform, encountered issues with racing condition of IAM role and AWS Resources creation.

For example, in their TF creation of a Step Function and IAM role, the Step Function failed due to missing IAM role dependencies.

I don't recall encounter similar issue in Cloudformation. can I ask if Cloudformation has internal dependencies check on such eventual consistency such as IAM role prior to other resources creation, and that is missing in Terraform?

Also, they have raised a ticket to Terraform (https://github.com/terraform-providers/terraform-provider-aws/issues/7893), is there any stop gap? One option I can think of is to pre-create the IAM role prior to the AWS resources.

Accepted Answer

You'll need to await Terraform maintainers to comment on the bug that has been raised but in essence, CFN checks for resources to be 'stable' before continuing onto dependent items. It's happened before too - see https://github.com/terraform-providers/terraform-provider-aws/issues/838 for example.

This is a great opportunity to talk about the advantages of CFN.

Racing condition of IAM role creation and AWS resources

Relevant content