aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::IAM::Role - Inconsistent Behavior of CloudFormation default tags "aws:cloudformation:stack-id", "aws:cloudformation:logical-id", "aws:cloudformation:stack-name" for the resource AWS::IAM::Role.

Open
#1,066 2 comments 18 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::Role

### Resource Name

AWS::IAM::Role

### Issue Description

AWS::IAM::ROLE resource type is not supported to have CloudFormation default tags "aws:cloudformation:stack-id", "aws:cloudformation:logical-id", "aws:cloudformation:stack-name" even though the resource is successfully created.

### Expected Behavior

According to documentation[1]; I see when a resource is created through CloudFormation the following tags are applied automatically:
1. aws:cloudformation:logical-id

2. aws:cloudformation:stack-id

3. aws:cloudformation:stack-name

References:
[1] Resource tag - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html

### Observed Behavior

But for the resource AWS::IAM::ROLE I didn't see this behavior although the CloudFormation support the "Tags" property on this resource.

I have observed the similar behavior to some more resource types like "AWS::ElasticLoadBalancingV2::LoadBalancer".

### Test Cases

Try using the below sample template for role creation:
```
AWSTemplateFormatVersion: 2010-09-09
Description: IAM Roles Stack
Resources:
Role:
Type: 'AWS::IAM::Role'
Properties:
Path: /
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- iot.amazonaws.com
Action:
- 'sts:AssumeRole'
MaxSessionDuration: 3600
```

Once the role is created; review the Tags section of the role in IAM console; you won't be seeing the below tags as expected:

1. aws:cloudformation:logical-id

2. aws:cloudformation:stack-id

3. aws:cloudformation:stack-name

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the sample CloudFormation template in the issue and inspect the created AWS::IAM::Role in the IAM console. Compare the observed Tags with the three documented CloudFormation default tags; done means the inconsistency is resolved or the supported behavior is clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.