Terraform：模块的depends_on 在AWS 中无法按预期工作

Question

I am new to terraform. I was working with terraform v0.12 previously and since I wanted to bring in a dependency between modules, I started using terraform v0.13 recently. I am trying to create an IAM role and attach a few policies to the created role. But the issue arises in policy attachment to the role. Few policies are getting attached to the role but some policies throw an error saying no such role exists while the other policies are attached to the role properly. Is there anything wrong in my implementation?

module.tf

provider "aws" {
  region = "ap-southeast-1"
}

#Control Plane role and policies

module "ControlPlane_Role" {

  source = "../../templates/IAM/roles"
  role_name = var.EKS-master-role
}

module "ControlPlane_Policy1" {

  source = "../../templates/IAM/aws_policy"
  role_name = var.EKS-master-role
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  depends_on = [module.ControlPlane_Role.role_create]
}

module "ControlPlane_Policy2" {

  source = "../../templates/IAM/aws_policy"
  role_name = var.EKS-master-role
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
  depends_on = [module.ControlPlane_Role.role_create]
}

templates/IAM/roles/role.tf

resource "aws_iam_role" "role_create" {
  assume_role_policy = data.aws_iam_policy_document.trusted_entity.json
  name               = var.role_name
}

aws_policy.tf

resource "aws_iam_role_policy_attachment" "aws_policy" {
  role       = var.role_name
  policy_arn = var.policy_arn
}

I'll be passing the variable files separately and there are no issues with that.

Error:

Error: Error attaching policy arn:aws:iam::aws:policy/AmazonEKSClusterPolicy to IAM Role EKS-master: NoSuchEntity: The role with name EKS-master cannot be found.

Error attaching policy arn:aws:iam::aws:policy/AmazonEKSServicePolicy to IAM Role EKS-master: NoSuchEntity: The role with name EKS-master cannot be found.

If I re-run the command terraform apply again on the same resources without any change, the policies are getting attached.

Answer 1

You shouldn't use depends_on except for some exceptional cases. From the templates/IAM/roles , define an output that is the name of the role and in the other modules pass this output ( role_name = module.ControlPlane_Role.output_role_name ). With this setup, the dependency graph is clear (create the role, create the things that depend on the role) instead of having to manually define dependencies with depends_on .