Terraform: Error Creating Iam Role. Malformedpolicydocument: Has Prohibited Field Resource

You need to mention sts:AssumeRole. You can directly attach policy using aws_iam_role_policy_attachment instead of duplicating existing policy.

resource "aws_iam_role" "ec2_iam_role" {
  name = "ec2_iam_role"
  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ec2.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

resource "aws_iam_role_policy_attachment" "ec2-read-only-policy-attachment" {
    role = "${aws_iam_role.ec2_iam_role.name}"
    policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess"
}

I had faced similar issue when using role arn. When I tried using aws_iam_role_policy_attachment - I was getting error for role name having unsupported characters.

What worked for me for to create a aws_iam_role_policy as below:

resource "aws_iam_role_policy" "api-invoker" {
    provider = <some provider>
    role     = aws_iam_role.api-invoker.id
    policy   = data.aws_iam_policy_document.execute-api.json
}

data "aws_iam_policy_document" "execute-api" {
    statement {
     sid = "all"
     actions = [
       "execute-api:*",
     ]
     resources = [
       "*"
     ]
   }
}

I have faced the same issue while i am creating a policy to assume role from another AWS account. So, I have added another AWS account Id in the trusted entities then the problem is resolved.