Terraform AWS provider "EntityAlreadyExists" for an IAM resource in CI

IAM rejected the create because an entity with that name already exists in the account. Terraform tried to create it because state has no record of it, so the names collide.

What this error means

terraform apply fails with "EntityAlreadyExists: Role with name X already exists" (or Policy/User/InstanceProfile). The resource exists in AWS but not in the state Terraform is using.

Terraform

Error: creating IAM Role (deploy): operation error IAM: CreateRole,
https response error StatusCode: 409, api error EntityAlreadyExists:
Role with name deploy already exists.

Common causes

The entity was created outside this state

Someone created the role manually, or a previous run used a different backend/workspace, so this state has no record of it.

A name collision across environments

A fixed IAM name (not suffixed per environment) clashes because the account already has one from another stack.

How to fix it

Import the existing entity into state

Confirm the existing entity is the one you want Terraform to manage.
Import it into the address in your config.
Re-run plan; Terraform should show no create, only in-place adjustments.

Terminal

terraform import aws_iam_role.deploy deploy

Give the entity a unique name

If the collision is across environments, derive the name so each stack is distinct instead of importing.

main.tf

name = "deploy-${var.environment}"

How to prevent it

Suffix IAM names per environment so stacks never collide.
Use one backend/workspace consistently so state reflects reality.
Import pre-existing resources before the first apply.