resource "aws_kinesis_firehose_delivery_stream" "my_tracking_stream" {

 depends_on = [
   aws_kinesis_stream.my_tracking_stream,
   aws_iam_role.firehose_role,
   aws_iam_role.kinesis_role
 ]


  s3_configuration {
    role_arn           = aws_iam_role.firehose_role.arn
    bucket_arn         = var.bucket_arn
    buffer_size        = 10
    buffer_interval    = 400
    compression_format = "GZIP"
  }

 kinesis_source_configuration {
   kinesis_stream_arn = aws_kinesis_stream.my_tracking_stream.arn
   role_arn           = aws_iam_role.kinesis_role.arn
 }

...
}

resource "aws_iam_role" "kinesis_role" {
  name = "kinesis_role_${terraform.workspace}"

  assume_role_policy = <<EOF
{
    "Version": "2012-10-17",
    "Statement":
    [
        {
            "Effect": "Allow",
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:GetBucketLocation",
                "s3:GetObject",
                "s3:ListBucket",
                "s3:ListBucketMultipartUploads",
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::my-kinesis-firehose-bucket-production",
                "arn:aws:s3:::my-kinesis-firehose-bucket-production/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "kinesis:DescribeStream",
                "kinesis:GetShardIterator",
                "kinesis:GetRecords",
                "kinesis:ListShards"
            ],
            "Resource": "arn:aws:kinesis:.....:stream/my-streaming-data-production"
        }
    ]
}
EOF

    tags = {
    Name        = "Kinesis role"
    Environment = terraform.workspace
  }
}

ror creating IAM Role kinesis_role_test: MalformedPolicyDocument: Has prohibited field Resource

network {
    port = openstack_networking_port_v2.be-port.id
  }
  network {
    port = openstack_networking_port_v2.fe-port.id
  }

Error: orphan resource gitlab_project_variable.variablename still has a non-empty state after apply; this is a bug in Terraform