title: Terraform: assume_role block is breaking the deployment
body: <p>I have two separate AWS accounts. I want to create a replica of the Account1[A1] infrastructure in Account[A2] using Terraform. When I create (eg) a blog instance , I want to take an Elastic IP and register it with a new R53 record in R53 service of the first account.</p>
  
  <p>I fetch the existing blog AMI id to use in order to launch EC2 instances, with a data resource . eg...</p>
  
  <pre><code>data "aws_ami" "blog-ami-source" {
    owners = ["self"] # The account ID
    filter {
      name = "state"
      values = ["available"]
    }
    filter {
      name = "tag:Name"
      values = ["Blog"]
    }
    most_recent = true
  }
  </code></pre>
  
  <p>For this example blog, I create an Elastic IP resource to attach to. Then I want to create an R53 record with this IP in A1's R53 , something like <code>blog-terra.example.com</code> .</p>
  
  <p>For this to happen I read the docs <a href="https://www.terraform.io/docs/providers/aws/" rel="nofollow noreferrer">here</a> &amp; <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html" rel="nofollow noreferrer">here</a> and I have created a role in the first account and attached an inline policy in the Terraform user in the second account. So I have this code</p>
  
  <pre><code>### The AWS provider configuration ###
  provider "aws" {
    # Grab the credentials dynamically from the credentials file
    # Windows setup
    shared_credentials_file  = "C:\\Users\\USER\\.aws\\credentials"
    # Linux setup
    //  shared_credentials_file  = "$HOME/.aws/credentials"
  
    profile = "TF_User" # the terraform user applies only to the 2nd account
  
    region  = "${var.aws_region}"
  
    assume_role {
      role_arn = "arn:aws:iam::${var.aws_account_id_1}:role/${var.R53_cross_account_role_name}"
      session_name = "SESSION_for_${var.R53_cross_account_role_name}"
    }
  }
  
  provider "aws" {
    alias = "account_1_provider"
    shared_credentials_file  = "C:\\Users\\USER\\.aws\\credentials"
    profile = "Generic_User" # the Generic user applies only to the 1st account
    region  = "${var.aws_region}"
  } 
  </code></pre>
  
  <p>also the code that creates the R53 records is this</p>
  
  <pre><code>data "aws_route53_zone" "main" {
    provider = "aws.account_1_provider"
    name = "example.com." # Notice the dot!!!
    private_zone = false
  }
  
  resource "aws_route53_record" "Blog_route" {
    zone_id = "${data.aws_route53_zone.main.zone_id}"
    name = "blog-terra.${data.aws_route53_zone.main.name}"
    type = "A"
    ttl = "300"
    records = ["${aws_eip.Blog_EIP.public_ip}"]
  </code></pre>
  
  <p>When I <code>terraform plan</code> it, I get this errors:</p>
  
  <pre><code>* data.aws_acm_certificate.elb-cert: Error describing certificates: AccessDeniedException: User: arn:aws:sts::ACCOUNT-ID:assumed-role/Access_to_R53_for_Terraform_user
  /SESSION_for_Access_to_R53_for_Terraform_user is not authorized to perform: acm:ListCertificates
          status code: 400, request id: 61f4fb62-fa77-11e6-a50d-95488550532b
  * data.aws_ami.blog-ami-source: UnauthorizedOperation: You are not authorized to perform this operation.
          status code: 403, request id: 766558dd-bf7c-4c55-95de-104a556a4b5a
  </code></pre>
  
  <p>It seems that the role to access the first account immediately applies and the rest of the operation breaks.</p>
  
  <p>However if isolate the necessary code to create the R53 records with hardcoded IPs, the assumed role works fine and the records are created perfectly.</p>
  
  <p>Do I do something wrong in the declaration of the assumed role?</p>