🚨 AWS Error: 'ConcurrentModificationException' — Cause, Fix, and Troubleshooting Guide

Overview

Several AWS services serialize mutations to a single resource. When two calls try to modify the same IAM role, Auto Scaling group, or similar resource concurrently, the service rejects one of them with ConcurrentModificationException to protect consistency. It is a transient, retryable error — the usual culprit is parallel infrastructure-as-code applying overlapping changes to one entity.

You will see it surface from the CLI, an SDK, or Terraform:

An error occurred (ConcurrentModificationException) when calling the AttachRolePolicy operation: Cannot modify the policy of a role that is being modified concurrently. Please try again.

Auto Scaling phrases it similarly:

An error occurred (ResourceContention) when calling the UpdateAutoScalingGroup operation: You already have a pending update to an Auto Scaling resource.

It occurs whenever two operations mutate one resource at the same time, or a follow-up call arrives before the previous change is fully consistent.

Symptoms

• AttachRolePolicy, PutRolePolicy, UpdateAutoScalingGroup, or similar fails with ConcurrentModificationException / ResourceContention.
• terraform apply fails intermittently attaching multiple policies to one role, and succeeds on re-run.
• Two pipelines (or a pipeline and a human) touch the same IAM role or ASG at once.
• The error is sporadic and disappears when the operation is retried.

aws iam attach-role-policy --role-name app-exec --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess &
aws iam attach-role-policy --role-name app-exec --policy-arn arn:aws:iam::aws:policy/AmazonSQSFullAccess &
wait

An error occurred (ConcurrentModificationException) when calling the AttachRolePolicy operation: ... being modified concurrently. Please try again.

Common Root Causes

1. Parallel IaC modifying one resource

Terraform (default parallelism 10) attaches several managed policies to the same role simultaneously, and the calls collide.

2. Two pipelines or actors at once

A deploy job and a drift-remediation job (or two pipeline runs) mutate the same IAM entity/ASG concurrently.

3. Follow-up call before consistency settles

A second mutation arrives before the previous one is fully applied.

4. A loop attaching many policies/rules to one entity

A script fanning out attachments to a single role without serializing them.

How to diagnose

Step 1: Confirm it’s concurrency, not permissions

aws iam attach-role-policy --role-name app-exec \
  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess 2>&1 \
  | grep -o 'ConcurrentModificationException'

A clean single call succeeding (while the parallel version fails) confirms contention, not an IAM/permission problem.

Step 2: Find overlapping callers in CloudTrail

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=app-exec \
  --start-time "$(date -u -d '10 min ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --query 'Events[].[EventTime,EventName,Username]' --output table

Two principals mutating within the same second is the smoking gun.

Fixes

Serialize modifications to the same resource

Attach policies one at a time (or gate the resource behind a deploy lock) rather than fanning out:

for p in AmazonS3ReadOnlyAccess AmazonSQSFullAccess; do
  aws iam attach-role-policy --role-name app-exec --policy-arn arn:aws:iam::aws:policy/$p
done

Reduce Terraform parallelism for the apply

terraform apply -parallelism=1

Or prefer a single managed_policy_arns list on the role (one call) over many separate aws_iam_role_policy_attachment resources.

Retry with exponential backoff

Because it’s transient, a bounded retry loop resolves it — the AWS SDKs and the Terraform AWS provider already retry ConcurrentModificationException for many operations; extend max_attempts if needed.

Add state locking to prevent multi-runner races

Use Terraform state locking (e.g. an S3 backend with a DynamoDB lock table) so two pipeline runs can’t apply to the same resources at once.

What to watch out for

• This is a transient error — never treat it as a hard failure; retry with backoff first.
• Reducing Terraform parallelism fixes the symptom but slows applies; consolidating attachments into one call is the cleaner fix.
• The real defense against multi-runner collisions is state locking, not just retries.
• ResourceContention on Auto Scaling is the same idea — one pending update at a time per ASG.

Related

• AWS Error: Lambda ‘ResourceConflictException … update is in progress’ — the same concurrent-mutation pattern on Lambda.
• AWS Error: ‘DeleteConflict’ deleting an IAM entity — another IAM state-conflict error.
• AWS Error: ‘Throttling: Rate exceeded’ / RequestLimitExceeded — the retry-and-backoff discipline that also applies here.