Terraform Error: MalformedPolicyDocument in IAM Role Creation

• Introduction
• Step-by-Step Guide
• Code Example
• Additional Notes
• Summary
• Conclusion
• References

The error message "MalformedPolicyDocument: Has prohibited field Resource" is a common issue encountered when defining IAM policies in Terraform. It often stems from incorrectly placing the "Resource" element within the policy document. While Terraform uses its own syntax, the policy argument within the aws_iam_policy resource expects a JSON-formatted string. This leads to confusion, with users mistakenly placing the "Resource" element directly within the policy block. The correct approach is to nest the "Resource" element within a "Statement" block inside the JSON policy document. Each statement represents a permission, specifying the desired action ("Action") and the resources it applies to ("Resource"). Remember that the "Resource" element should always be part of a statement and not directly within the policy block. By adhering to this structure and ensuring valid JSON formatting, you can avoid the "MalformedPolicyDocument" error and effectively manage your IAM policies in Terraform.

The error message "MalformedPolicyDocument: Has prohibited field Resource" typically occurs when defining IAM policies in Terraform due to a misunderstanding of where the "Resource" element should be placed.

Here's a breakdown:

1. Policy Structure: IAM policies in Terraform often utilize the aws_iam_policy resource. Within this resource, you define the policy document using the policy argument.

2. JSON vs. Terraform Syntax: The policy argument expects a JSON-formatted string. However, when writing Terraform, we use its native syntax. This is where the confusion arises.

3. Incorrect Placement: The error message indicates that the "Resource" element is present within the policy block itself. This is incorrect. The "Resource" element should be nested within a "Statement" block inside the policy document.

4. Correct Structure: Here's how the structure should look:

resource "aws_iam_policy" "example" {
  name        = "example"
  path        = "/"
  description = "Example IAM policy"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::examplebucket/*"]
    }
  ]
}
EOF
}

5. Explanation:

   • The policy argument contains a JSON string.
   • Within the JSON, there's a "Statement" array.
   • Each statement has "Effect," "Action," and "Resource" elements.
   • The "Resource" element specifies the AWS resources the policy applies to.

6. Additional Notes:

   • Ensure your JSON is valid. Terraform can be sensitive to formatting errors.
   • The "Principal" element is used in trust policies (e.g., for roles) to define who can assume the role, not in regular IAM policies.
   • If you're using data "aws_iam_policy_document", the same principle applies – "Resource" goes within a "Statement."

By adhering to the correct structure and understanding the distinction between Terraform syntax and the JSON format required for IAM policies, you can avoid this error and successfully manage your AWS IAM resources.

The code demonstrates the "MalformedPolicyDocument: Has prohibited field Resource" error in Terraform when defining an IAM policy. The error occurs because the "Resource" element is incorrectly placed outside the "Statement" block in the policy document. The solution is to move the "Resource" element inside the "Statement" block, ensuring the policy adheres to the correct JSON format. This placement is crucial for the policy to be valid and avoid the error.

Here's a code example demonstrating the error and its solution:

Incorrect Code (Leading to Error):

resource "aws_iam_policy" "incorrect_example" {
  name        = "incorrect_example"
  path        = "/"
  description = "Incorrect IAM policy with Resource in the wrong place"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"]
    }
  ],
  "Resource": ["arn:aws:s3:::examplebucket/*"] // Incorrect placement of Resource
}
EOF
}

This code will result in the "MalformedPolicyDocument: Has prohibited field Resource" error because the "Resource" element is placed outside the "Statement" block.

Correct Code:

resource "aws_iam_policy" "correct_example" {
  name        = "correct_example"
  path        = "/"
  description = "Correct IAM policy with Resource in the correct place"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::examplebucket/*"] // Correct placement of Resource
    }
  ]
}
EOF
}

This code places the "Resource" element correctly within the "Statement" block, adhering to the JSON format required for IAM policies and avoiding the error.

Key Takeaway:

Always ensure that the "Resource" element is nested within a "Statement" block in your IAM policy document, whether you're defining it directly in an aws_iam_policy resource or using data "aws_iam_policy_document". This will prevent the "MalformedPolicyDocument: Has prohibited field Resource" error and ensure your Terraform code functions correctly.

Here are some additional notes to complement the article:

Understanding the Root Cause:

• Terraform's Role: Terraform acts as a translator between your infrastructure definitions and AWS APIs. It doesn't directly interpret JSON.
• AWS's Expectation: AWS APIs, specifically for IAM policies, strictly require the policy document to be in valid JSON format.
• The Disconnect: The error arises from placing the "Resource" element in a way that's valid in Terraform's syntax but breaks the expected JSON structure for AWS.

Debugging Tips:

• Validate JSON: Before applying your Terraform code, use online JSON validators or the jq command-line tool to ensure your policy document is structurally sound.
• Break Down Complex Policies: If you have a large policy, try defining smaller, individual statements first. This can help isolate the source of the error.
• Examine AWS Documentation: Refer to the official AWS IAM policy documentation for detailed explanations of policy elements and their correct usage.

Beyond aws_iam_policy:

• aws_iam_role_policy: The same principle applies when defining inline policies within IAM roles using the aws_iam_role_policy resource.
• AWS Console for Reference: If you're unsure about the correct structure, create a similar policy manually in the AWS Management Console and observe the generated JSON.

Best Practices:

• Use Heredoc for Readability: For complex JSON policies, utilize Terraform's Heredoc syntax (as shown in the examples) to improve readability and reduce the chance of syntax errors.
• Modularize Policies: For larger projects, consider defining reusable policy documents as separate modules to promote consistency and maintainability.

By understanding the underlying cause of the error and following these best practices, you can write clean, error-free Terraform code for managing your AWS IAM policies.

This error occurs when defining IAM policies in Terraform due to incorrect placement of the "Resource" element within the policy document.

Correct Structure:

resource "aws_iam_policy" "example" {
  # ... other arguments ...

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::examplebucket/*"] 
    }
  ]
}
EOF
}

Key Points:

• "Resource" specifies the AWS resources the policy applies to.
• "Principal" is used in trust policies, not regular IAM policies.
• The same principle applies when using data "aws_iam_policy_document".

By following the correct structure and understanding the difference between Terraform syntax and JSON format, you can avoid this error and manage your IAM resources effectively.

In conclusion, encountering the "MalformedPolicyDocument: Has prohibited field Resource" error in Terraform, while frustrating, points to a fundamental aspect of IAM policy construction. The error arises from positioning the "Resource" element directly within the policy block, a structure valid in Terraform's syntax but incorrect for the JSON format expected by AWS. The solution lies in understanding that "Resource" should always be nested within a "Statement" block within the JSON policy document. Each statement encapsulates a permission, detailing the allowed actions ("Action") and the specific resources those actions apply to ("Resource"). By consistently placing "Resource" within a "Statement" and ensuring the overall policy document adheres to valid JSON structure, you can confidently manage your IAM policies in Terraform, avoiding this common error and ensuring your infrastructure definitions translate accurately to secure AWS configurations.

• Fixing the Terraform Error creating IAM Role ... | Jun 20, 2023 ... Fixing the Terraform Error creating IAM Role. MalformedPolicyDocument Has prohibited field Resource · Unraveling The IAM Policy Document. To ...
• Defining a role with access to multiple AWS services : r/Terraform | Posted by u/ElectricalFilm2 - 1 vote and 4 comments
• Malformed Policy Document: Has prohibited field Resource - Stack ... | Jan 10, 2022 ... I'm trying to create an IAM Role and IAM Policy using Terraform. I'm getting this error: │ Error: error creating IAM Role (asg-domain-join- ...
• Creating IAM roles and policy | May 16, 2016 ... ... Terraform to create and manage IAM roles ... Error creating IAM Role VCI-FlowLogs2: MalformedPolicyDocument: Has prohibited field Resource.
• Terraform AWS IAM Error — “MalformedPolicyDocument: Policy ... | I’m still a bit lost when it comes to understanding the nitty-gritty of IAM and I was a little stumped when I encountered this error…
• Resolve the IAM policy error "Has prohibited field Principal" | AWS re ... | How can I resolve the error "Has prohibited field Principal" with my AWS Identity and Access Management (IAM) policy?
• ![MalformedPolicyDocument: Invalid principal in policy: "AWS" Only ... [MalformedPolicyDocument: Invalid principal in policy: "AWS" Only ... | #1388 The documentation specifically says this is allowed: https://www.terraform.io/docs/providers/aws/d/iam_policy_document.html#example-with-multiple-principals data "aws_caller_identity" "caller...
• Terraform + AWS環境でIAMポリシーを書いていたら ... | 全く大した話ではなく、TerraformでEC2にIAMポリシーを割り当てようとコードを書いていたら掲題のエラーが出力されて少し調べたのでメモ。Terraform: Error creating …
• terraform | ... contains a field named "Resource" that shouldn't be there. Fixing the Terraform Error creating IAM Role. MalformedPolicyDocument Has prohibited field Resource.