Merge pull request #11915 from hashicorp/f-validate-policy

provider/aws: JSON Validate iam_role

builtin/providers/aws/resource_aws_iam_role.go

@@ -82,10 +82,11 @@ func resourceAwsIamRole() *schema.Resource {
 				ForceNew: true,
 			},
 
-			"assume_role_policy": &schema.Schema{
+			"assume_role_policy": {
 				Type:             schema.TypeString,
 				Required:         true,
 				DiffSuppressFunc: suppressEquivalentAwsPolicyDiffs,
+				ValidateFunc:     validateJsonString,
 			},
 
 			"create_date": {

builtin/providers/aws/resource_aws_iam_role_test.go

@@ -5,6 +5,8 @@ import (
 	"strings"
 	"testing"
 
+	"regexp"
+
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
@@ -81,6 +83,20 @@ func TestAccAWSRole_testNameChange(t *testing.T) {
 	})
 }
 
+func TestAccAWSRole_badJSON(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSRoleDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSRoleConfig_badJson,
+				ExpectError: regexp.MustCompile(`"assume_role_policy" contains an invalid JSON:.*`),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSRoleDestroy(s *terraform.State) error {
 	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -279,3 +295,24 @@ resource "aws_iam_instance_profile" "role_update_test" {
 }
 
 `
+
+const testAccAWSRoleConfig_badJson = `
+	resource "aws_iam_role" "my_instance_role" {
+  name = "test-role"
+
+  assume_role_policy = <<POLICY
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com",
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+POLICY
+}`