{"action":"closed","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/2880","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/2880/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/2880/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/2880/events","html_url":"https://github.com/hashicorp/terraform/issues/2880","id":97899850,"number":2880,"title":"IAM role not recognised when creating aws_ecs_service","user":{"login":"philp","id":100245,"avatar_url":"https://avatars.githubusercontent.com/u/100245?v=3","gravatar_id":"","url":"https://api.github.com/users/philp","html_url":"https://github.com/philp","followers_url":"https://api.github.com/users/philp/followers","following_url":"https://api.github.com/users/philp/following{/other_user}","gists_url":"https://api.github.com/users/philp/gists{/gist_id}","starred_url":"https://api.github.com/users/philp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philp/subscriptions","organizations_url":"https://api.github.com/users/philp/orgs","repos_url":"https://api.github.com/users/philp/repos","events_url":"https://api.github.com/users/philp/events{/privacy}","received_events_url":"https://api.github.com/users/philp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/bug","name":"bug","color":"f7c6c7"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-07-29T09:52:36Z","updated_at":"2015-07-29T09:58:35Z","closed_at":"2015-07-29T09:58:35Z","body":"I have a Terraform file which sets up an AWS auto-scaling group and creates ECS tasks. These also sit behind a load balancer. When I run `terraform apply` for the first time, almost everything runs fine, but when it comes to creating the `aws_ecs_service`, I get this error:\r\n\r\n```\r\n* InvalidParameterException: Unable to assume role and validate the listeners configured on your load balancer.  Please verify the role being passed has the proper permissions.\r\n\tstatus code: 400, request id: []\r\n```\r\n\r\nIf I re-apply a second time, then it works, and I can verify that everything is set up as expected in the AWS console. Seems like there is some sort of problem with the role I'm creating, and it not being recognised when this part of the deployment happens.\r\n\r\nHere is a snapshot of the main `.tf` file I'm using (note: it's a work-in-progress so probably full of bad practice!):\r\n\r\n```\r\n\r\n/**\r\n * AWS provider\r\n */\r\nprovider \"aws\" {\r\n    access_key = \"${var.access_key}\"\r\n    secret_key = \"${var.secret_key}\"\r\n    region = \"${var.region}\"\r\n}\r\n\r\n/**\r\n * IAM role to allow ECS to assume control of EC2 instances\r\n */\r\nresource \"aws_iam_role\" \"ecs\" {\r\n    name = \"gocd-ecs\"\r\n    path = \"/\"\r\n    assume_role_policy = \"${file(\"iam-policies/ecs-role.json\")}\"\r\n}\r\n\r\n/**\r\n * IAM role to allow control EC2\r\n */\r\nresource \"aws_iam_role_policy\" \"ecs\" {\r\n    name = \"gocd-ecs\"\r\n    role = \"${aws_iam_role.ecs.id}\"\r\n    policy = \"${file(\"iam-policies/ecs-role-policy.json\")}\"\r\n}\r\n\r\n/**\r\n * IAM role for services\r\n */\r\nresource \"aws_iam_role\" \"gocd\" {\r\n    name = \"gocd-service\"\r\n    path = \"/\"\r\n    assume_role_policy = \"${file(\"iam-policies/service-role.json\")}\"\r\n}\r\n\r\n/**\r\n * IAM policy for service roles\r\n */\r\nresource \"aws_iam_role_policy\" \"gocd\" {\r\n    name = \"gocd-service\"\r\n    role = \"${aws_iam_role.gocd.id}\"\r\n    policy = \"${file(\"iam-policies/service-role-policy.json\")}\"\r\n}\r\n\r\n/**\r\n * Provides internal access to container ports\r\n */\r\nresource \"aws_security_group\" \"ecs\" {\r\n  name = \"gocd-ecs\"\r\n  description = \"Container Instance Allowed Ports\"\r\n\r\n  ingress {\r\n    from_port = 1\r\n    to_port   = 65535\r\n    protocol  = \"tcp\"\r\n    cidr_blocks = [\"0.0.0.0/0\"]\r\n  }\r\n\r\n  egress {\r\n      from_port = 0\r\n      to_port = 0\r\n      protocol = \"-1\"\r\n      cidr_blocks = [\"0.0.0.0/0\"]\r\n  }\r\n\r\n  tags {\r\n    Name = \"gocd-ecs\"\r\n  }\r\n}\r\n\r\n/**\r\n * IAM profile to be used in auto-scaling launch configuration.\r\n */\r\nresource \"aws_iam_instance_profile\" \"ecs\" {\r\n    name = \"gocd-ecs\"\r\n    path = \"/\"\r\n    roles = [\"${aws_iam_role.ecs.name}\"]\r\n}\r\n\r\n/**\r\n * Launch configuration used by autoscaling group\r\n */\r\nresource \"aws_launch_configuration\" \"ecs\" {\r\n    name = \"gocd-ecs\"\r\n    image_id = \"ami-7948320e\"\r\n    instance_type = \"t2.micro\"\r\n    security_groups = [\"${aws_security_group.ecs.id}\"]\r\n    iam_instance_profile = \"${aws_iam_instance_profile.ecs.name}\"\r\n    user_data = \"${file(\"ecs.sh\")}\"\r\n}\r\n\r\n/**\r\n * Autoscaling group.\r\n */\r\nresource \"aws_autoscaling_group\" \"ecs\" {\r\n    name = \"gocd-ecs\"\r\n    availability_zones = [\"eu-west-1a\"]\r\n    launch_configuration = \"${aws_launch_configuration.ecs.name}\"\r\n    min_size = 1\r\n    max_size = 10\r\n    desired_capacity = 1\r\n}\r\n\r\n/**\r\n * ECS cluster\r\n */\r\nresource \"aws_ecs_cluster\" \"gocd\" {\r\n    name = \"gocd\"\r\n}\r\n\r\n/**\r\n * Load balancer\r\n */\r\nresource \"aws_elb\" \"gocd\" {\r\n    name = \"gocd\"\r\n    availability_zones = [\"eu-west-1a\"]\r\n    connection_draining = false\r\n\r\n    listener {\r\n        instance_port = 8153\r\n        instance_protocol = \"http\"\r\n        lb_port = 80\r\n        lb_protocol = \"http\"\r\n    }\r\n\r\n    health_check {\r\n        healthy_threshold = 2\r\n        unhealthy_threshold = 2\r\n        timeout = 60\r\n        target = \"HTTP:8153/\"\r\n        interval = 300\r\n    }\r\n\r\n}\r\n\r\n/**\r\n *\r\n */\r\nresource \"aws_ecs_task_definition\" \"gocd\" {\r\n    family = \"gocd\"\r\n    container_definitions = \"${file(\"task-definitions/gocd.json\")}\"\r\n}\r\n\r\n/**\r\n *\r\n */\r\nresource \"aws_ecs_service\" \"gocd\" {\r\n    name = \"gocd\"\r\n    cluster = \"${aws_ecs_cluster.gocd.id}\"\r\n    task_definition = \"${aws_ecs_task_definition.gocd.id}\"\r\n    iam_role = \"${aws_iam_role.gocd.id}\"\r\n    desired_count = 1\r\n\r\n    load_balancer {\r\n        elb_name = \"${aws_elb.gocd.id}\"\r\n        container_name = \"gocd\"\r\n        container_port = 8153\r\n    }\r\n\r\n}\r\n```"}}