Missing actions with running Terraform via proxy

[mentoc3000]

I'm running iamlive in proxy mode to capture the calls made from a terraform deployment. I'm capturing the iam: actions but nothing else.

I launch iamlive using the following:

export AWS_ACCESS_KEY_ID=<id>
export AWS_SECRET_ACCESS_KEY=<key>
export AWS_SESSION_TOKEN=<token>

iamlive --set-ini --mode proxy --force-wildcard-resource

Here is my Terraform configuration:

provider "aws" {
  region = "us-east-1"
}

provider "awscc" {
  region = "us-east-1"
}

provider "opensearch" {
  url         = module.bedrock.default_collection.collection_endpoint
  healthcheck = false
  insecure    = true
}

module "bedrock" {
  source                 = "aws-ia/bedrock/aws"
  version                = "0.0.26"
  foundation_model       = "anthropic.claude-3-haiku-20240307-v1:0"
  instruction            = "You are a helpful and friendly agent that answers questions about literature."
  create_default_kb      = true
  kb_embedding_model_arn = "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v1"
  vector_dimension       = 1536
}

I apply the config using

export AWS_ACCESS_KEY_ID=<id>
export AWS_SECRET_ACCESS_KEY=<key>
export AWS_SESSION_TOKEN=<token>
export HTTP_PROXY=http://127.0.0.1:10080
export HTTPS_PROXY=http://127.0.0.1:10080
export AWS_CA_BUNDLE=~/.iamlive/ca.pem

terraform apply

iamlive runs without error but only outputs the following:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sts:GetCallerIdentity",
                "iam:GetRole",
                "iam:CreateRole",
                "iam:ListRolePolicies",
                "iam:ListAttachedRolePolicies",
                "iam:PutRolePolicy",
                "iam:GetRolePolicy",
                "iam:CreatePolicy",
                "iam:GetPolicy",
                "iam:GetPolicyVersion",
                "iam:AttachRolePolicy",
                "iam:DeleteRolePolicy",
                "iam:DetachRolePolicy",
                "iam:ListPolicyVersions",
                "iam:DeletePolicy",
                "iam:ListInstanceProfilesForRole",
                "iam:DeleteRole"
            ],
            "Resource": "*"
        }
    ]
}

Any suggestions on what I might be doing wrong?

[iann0036]

Hi @mentoc3000,

Thanks for reaching out. Though --set-ini is not required / compatible for the initial call (that option is for csm mode), the above configuration should work as you have it.

This is likely a mapping issue with the specific bedrock endpoint on my end. I'll need to replicate this and take a deeper look - please bear with me a few days before I have time to investigate.

[mentoc3000]

Digging into the tf logs, the actions that aren't getting captured have logs like this:

2025-06-03T13:38:54.523-0400 [WARN]  Provider "registry.terraform.io/hashicorp/aws" produced an invalid plan for module.bedrock.aws_iam_role_policy.kb_policy[0], but we are tolerating it because it is using the legacy plugin SDK.
    The following problems may be the cause of any confusing errors from downstream operations:
      - .policy: planned value cty.StringVal("{\"Version\":\"2012-10-17\",\"Statement\":[{\"Action\":\"bedrock:Retrieve\",\"Effect\":\"Allow\",\"Resource\":\"arn:aws:bedrock:us-east-1:************:knowledge-base/*\"}]}") does not match config value cty.StringVal("{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Action\": \"bedrock:Retrieve\",\n      \"Resource\": \"arn:aws:bedrock:us-east-1:************:knowledge-base/*\"\n    }\n  ]\n}")

[iann0036]

Hi @mentoc3000,

I've pushed a fix to hopefully allow it to detect the bedrock actions better. This is available as of v1.1.25.

Give it a go and let me know if it resolves your issue!

[mentoc3000]

When I run this with the latest version of iamlive I'm still not seeing any bedrock or aoss actions. What does your output look like?