aws_iam_role.tf

resource "aws_iam_role" "role" {
  name               = "test_role"
  assume_role_policy = "${data.aws_iam_policy_document.ec2-principal.json}"
}

resource "aws_iam_instance_profile" "test_profile" {
  name = "test_profile"
  role = "${aws_iam_role.role.name}"
}

policies.tf.json

  "data":{
    "aws_iam_policy_document":{
      "ec2-principal":{
        "statement": {
          "action": [
            "sts:AssumeRole"
          ],
          "principals": {
            "type": "Service",
            "identifiers": [
              "ec2.amazonaws.com"
            ]
          },
          "effect": "Allow"
        }
      },
      "s3-read-only":{
        "statement":{
          "action":[
            "s3:ListAllMyBuckets",
            "s3:GetBucketLocation"
          ],
          "resources":[
            "arn:aws:s3:::*"
          ]
        }
      }
    }
  }
}

Error while validating / terraform planning

[iam/terraform] (master) >>> terraform validate
Error loading files Error loading $DIR/iam/terraform/policies.tf.json: position -: 'data' must be followed by exactly two strings: a type and a name

However, Referring to hashicorp/terraform#13037, I modified the tf.json file as below.

{
  "data": [{
    "aws_iam_policy_document": [{
      "ec2-principal":{
        "statement": {
          "action": [
            "sts:AssumeRole"
          ],
          "principals": {
            "type": "Service",
            "identifiers": [
              "ec2.amazonaws.com"
            ]
          },
          "effect": "Allow"
        }
      },
      "s3-read-only":{
        "statement":{
          "action":[
            "s3:ListAllMyBuckets",
            "s3:GetBucketLocation"
          ],
          "resources":[
            "arn:aws:s3:::*"
          ]
        }
      }
    }]
  }]
}

Now, on doing terraform validate I am getting this error.

Error validating: 2 error(s) occurred:

* resource 'aws_iam_role.role' config: unknown resource 'data.aws_iam_policy_document.ec2-principal' referenced in variable data.aws_iam_policy_document.ec2-principal.json
* resource 'aws_iam_policy.policy' config: unknown resource 'data.aws_iam_policy_document.s3-read-only' referenced in variable data.aws_iam_policy_document.s3-read-only.json