Use the core Terraform workflow →hardMultiple ChoiceObjective-mapped

TF-004 Use the core Terraform workflow Practice Question

A DevOps engineer is troubleshooting a failed 'terraform apply'. The error message says: 'Error: Error applying IAM policy: The policy failed validation'. The IAM policy is defined using HCL in a JSON-encoded string. What is the most efficient way to debug this issue?

⚠ Common exam trap

HashiCorp often tests the misconception that `terraform plan` catches all errors, but plan only validates Terraform configuration syntax and state drift, not the semantic correctness of embedded JSON strings that are passed to external APIs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use a JSON validator tool to check the policy string in the configuration.

The error 'The policy failed validation' indicates that the JSON-encoded IAM policy string in the Terraform configuration is malformed or violates AWS IAM policy syntax. Using a JSON validator tool (e.g., `jq`, online validator, or `aws iam simulate-custom-policy`) directly checks the string's structure and compliance with AWS IAM policy schema, which is the most efficient first step before re-running Terraform. This isolates the issue from Terraform's execution logic and avoids unnecessary plan/apply cycles.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Run 'terraform plan' to see the detailed error.
Why it's wrong here
terraform plan primarily focuses on generating an execution plan by comparing the desired state with the current infrastructure and validating HCL syntax. It does not typically perform deep API-level validation of resource attributes like IAM policy JSON content for correctness against the cloud provider's schema or grammar. Policy validation errors, especially those related to malformed JSON or invalid policy statements, are usually encountered during the terraform apply phase when the provider attempts to send the policy to the cloud API.
✗
Use 'terraform console' to test the policy string.
Why it's wrong here
terraform console is an interactive command-line tool designed for evaluating Terraform expressions, interpolating variables, and testing logic within the configuration. While it can confirm if a string is valid JSON from a pure HCL perspective (e.g., jsondecode("...")), it lacks the capability to validate the semantic correctness or API-specific schema of an IAM policy document against a cloud provider's requirements. It cannot simulate the provider's API call to check policy validity.
✓
Use a JSON validator tool to check the policy string in the configuration.
Why this is correct
A JSON validator tool is highly effective for identifying fundamental syntax errors within an IAM policy string embedded in Terraform configuration. These tools can quickly pinpoint issues like malformed JSON structure, incorrect escaping, missing commas, or unclosed brackets, which are common causes of policy validation failures. Catching these errors locally prevents terraform apply from failing due to basic JSON parsing issues, allowing the DevOps engineer to correct the policy before deployment attempts.
✗
Upgrade to the latest Terraform version.
Why it's wrong here
Upgrading to the latest Terraform version is unlikely to resolve an issue stemming from a malformed IAM policy string within the configuration. Terraform version updates primarily address core CLI functionality, HCL language features, or provider compatibility, not the correctness of user-supplied data like JSON policy documents. A syntax error in the policy itself is a configuration issue, not a bug or limitation of the Terraform CLI version.

Go deeper

TF-004 Use the core Terraform workflow Practice Question

Why each option matters

Option-by-option breakdown

Related to this question