From 9a95816edf34a5b1726d00df342ea11122894c37 Mon Sep 17 00:00:00 2001
From: Jake Champlin <jake.champlin.27@gmail.com>
Date: Mon, 13 Feb 2017 14:27:14 -0500
Subject: [PATCH] provider/aws: JSON Validate iam_role

Validate the policy supplied via `assume_role_policy` in an `aws_iam_role`

```
$ make testacc TEST=./builtin/providers/aws TESTARGS='-run=TestAccAWSRole_badJSON'
==> Checking that code complies with gofmt requirements...
go generate $(go list ./... | grep -v /terraform/vendor/)
2017/02/13 14:13:47 Generated command/internal_plugin_list.go
TF_ACC=1 go test ./builtin/providers/aws -v -run=TestAccAWSRole_badJSON -timeout 120m
=== RUN   TestAccAWSRole_badJSON
--- PASS: TestAccAWSRole_badJSON (0.00s)
PASS
ok      github.com/hashicorp/terraform/builtin/providers/aws    0.019s
```
---
 .../providers/aws/resource_aws_iam_role.go    |  3 +-
 .../aws/resource_aws_iam_role_test.go         | 37 +++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/builtin/providers/aws/resource_aws_iam_role.go b/builtin/providers/aws/resource_aws_iam_role.go
index b24c1573f..3833ea278 100644
--- a/builtin/providers/aws/resource_aws_iam_role.go
+++ b/builtin/providers/aws/resource_aws_iam_role.go
@@ -82,10 +82,11 @@ func resourceAwsIamRole() *schema.Resource {
 				ForceNew: true,
 			},
 
-			"assume_role_policy": &schema.Schema{
+			"assume_role_policy": {
 				Type:             schema.TypeString,
 				Required:         true,
 				DiffSuppressFunc: suppressEquivalentAwsPolicyDiffs,
+				ValidateFunc:     validateJsonString,
 			},
 
 			"create_date": {
diff --git a/builtin/providers/aws/resource_aws_iam_role_test.go b/builtin/providers/aws/resource_aws_iam_role_test.go
index aa3613b8c..5d5c02925 100644
--- a/builtin/providers/aws/resource_aws_iam_role_test.go
+++ b/builtin/providers/aws/resource_aws_iam_role_test.go
@@ -5,6 +5,8 @@ import (
 	"strings"
 	"testing"
 
+	"regexp"
+
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/service/iam"
@@ -81,6 +83,20 @@ func TestAccAWSRole_testNameChange(t *testing.T) {
 	})
 }
 
+func TestAccAWSRole_badJSON(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		PreCheck:     func() { testAccPreCheck(t) },
+		Providers:    testAccProviders,
+		CheckDestroy: testAccCheckAWSRoleDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config:      testAccAWSRoleConfig_badJson,
+				ExpectError: regexp.MustCompile(`"assume_role_policy" contains an invalid JSON:.*`),
+			},
+		},
+	})
+}
+
 func testAccCheckAWSRoleDestroy(s *terraform.State) error {
 	iamconn := testAccProvider.Meta().(*AWSClient).iamconn
 
@@ -279,3 +295,24 @@ resource "aws_iam_instance_profile" "role_update_test" {
 }
 
 `
+
+const testAccAWSRoleConfig_badJson = `
+	resource "aws_iam_role" "my_instance_role" {
+  name = "test-role"
+
+  assume_role_policy = <<POLICY
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Action": "sts:AssumeRole",
+            "Principal": {
+                "Service": "ec2.amazonaws.com",
+            },
+            "Effect": "Allow",
+            "Sid": ""
+        }
+    ]
+}
+POLICY
+}`