IAM Roles Needed

[ezekieldas]

I had a heck of a time getting the Terraform to build. While I'm quickly cruising through this exercise, I may have overlooked a requirement in the docs somewhere. If so, would you kindly point it out.

In order for me to get this to build, and to avoid the ongoing errors such as this example here, it was necessary for me to attach the policy below to the user doing the terraform apply -var-file=./conf/00_hashicups.tfvar.

│ Error: adding role learn-consul-vms-o7yi202403050001392422001234 to IAM Instance Profile (learn-consul-vms-o7yi202403050007472373001234): adding IAM Role learn-consul-vms-o7yi202403050001392422001234to Instance Profile learn-consul-vms-o7yi202403050007472373001234: AccessDenied: User: arn:aws:iam::1234:user/aws2029-i is not authorized to perform: iam:PassRole on resource: arn:aws:iam::1234:role/learn-consul-vms-o7yi202403050001392422001234 because no identity-based policy allows the iam:PassRole action
│   status code: 403, request id: 46bc0d38-1ded-4a11-9c8b-1234

---

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:CreateInstanceProfile",
                "iam:GetRole",
                "iam:ListInstanceProfilesForRole",
                "iam:ListAttachedRolePolicies",
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:AttachRolePolicy",
                "iam:PutRolePolicy",
                "iam:ListRolePolicies",
                "iam:GetRolePolicy",
                "iam:GetInstanceProfile",
                "iam:DeleteRolePolicy",
                "iam:RemoveRoleFromInstanceProfile",
                "iam:DeleteInstanceProfile",
                "iam:AddRoleToInstanceProfile",
                "iam:PassRole"
            ],
            "Resource": "*"
        }
    ]
}