Webhook depreciation warning

[lionslair]

I just wanted to give some feedback. Since version 7.6.0 I started receiving this warning on terraform apply

╷
│ Warning: Deprecated value used
│ 
│   on .terraform/modules/github-runner/modules/webhook/direct/outputs.tf line 10, in output "webhook":
│   10:     role      = aws_iam_role.webhook_lambda
│ 
│   The deprecation originates from module.github-runner.module.webhook.module.direct[0].aws_iam_role.webhook_lambda.inline_policy
│ 
│ inline_policy is deprecated. Use the aws_iam_role_policy resource instead. If Terraform should exclusively manage all inline policy associations (the current behavior of this
│ argument), use the aws_iam_role_policies_exclusive resource as well.
│ 
│ (and one more similar warning elsewhere)

From what I can work out it is related to what is in the generated .terraform/github-runner/modules/webhook/outputs.tf

output "role" {
  value = !var.eventbridge.enable ? module.direct[0].webhook.role : module.eventbridge[0].webhook.role
}

to

role = {
  arn  = aws_iam_role.main.arn
  name = aws_iam_role.main.name
  id   = aws_iam_role.main.id
}

Not sure about making changes to the generated file though.

[zarnovican]

We see the same warning on a different module, but the root-cause is the same.

╷
│ Warning: Deprecated value used
│
│   on .terraform/modules/github_runners/modules/ami-housekeeper/outputs.tf line 10, in output "lambda_role":
│   10:   value = aws_iam_role.ami_housekeeper
│
│   The deprecation originates from module.github_runners.module.ami_housekeeper.aws_iam_role.ami_housekeeper.inline_policy
│
│ inline_policy is deprecated. Use the aws_iam_role_policy resource instead. If Terraform should exclusively manage all inline policy associations (the current behavior of this argument),
│ use the aws_iam_role_policies_exclusive resource as well.
│
│ (and 119 more similar warnings elsewhere)
╵

For us, it started after upgrading from terraform 1.14 to 1.15. See the related issue hashicorp/terraform#38554.

There are multiple places (20+) in this project where modules output the whole resource. Eg:

modules/ami-housekeeper/outputs.tf:
..
output "lambda_role" {
  value = aws_iam_role.ami_housekeeper
}

[edersonbrilhante]

The outputs are returning the whole role object(including the now deprecated inputs). The solution is to update the outputs and do something like this

output "dispatcher" {
  value = {
    lambda    = aws_lambda_function.dispatcher
    log_group = aws_cloudwatch_log_group.dispatcher
    role = {
      arn                   = aws_iam_role.dispatcher_lambda.arn
      assume_role_policy    = aws_iam_role.dispatcher_lambda.assume_role_policy
      create_date           = aws_iam_role.dispatcher_lambda.create_date
      description           = aws_iam_role.dispatcher_lambda.description
      force_detach_policies = aws_iam_role.dispatcher_lambda.force_detach_policies
      id                    = aws_iam_role.dispatcher_lambda.id
      max_session_duration  = aws_iam_role.dispatcher_lambda.max_session_duration
      name                  = aws_iam_role.dispatcher_lambda.name
      name_prefix           = aws_iam_role.dispatcher_lambda.name_prefix
      path                  = aws_iam_role.dispatcher_lambda.path
      permissions_boundary  = aws_iam_role.dispatcher_lambda.permissions_boundary
      tags                  = aws_iam_role.dispatcher_lambda.tags
      tags_all              = aws_iam_role.dispatcher_lambda.tags_all
      unique_id             = aws_iam_role.dispatcher_lambda.unique_id
    }
  }
}

Or wait until the provider removes.

I personally don't think is worth to modify all outputs because that.

[zarnovican]

Fyi, the fix was already merged in terraform (hashicorp/terraform#38778) in an unreleased version 1.16. Personally, I would stick to outputting the whole resource.

[edersonbrilhante]

Oh. Thanks for sharing the info.