aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::IAM::Role - Inconsistent Behavior of CloudFormation default tags "aws:cloudformation:stack-id", "aws:cloudformation:logical-id", "aws:cloudformation:stack-name" for the resource AWS::IAM::Role.
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::Role
### Resource Name
AWS::IAM::Role
### Issue Description
AWS::IAM::ROLE resource type is not supported to have CloudFormation default tags "aws:cloudformation:stack-id", "aws:cloudformation:logical-id", "aws:cloudformation:stack-name" even though the resource is successfully created.
### Expected Behavior
According to documentation[1]; I see when a resource is created through CloudFormation the following tags are applied automatically:
1. aws:cloudformation:logical-id
2. aws:cloudformation:stack-id
3. aws:cloudformation:stack-name
References:
[1] Resource tag - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html
### Observed Behavior
But for the resource AWS::IAM::ROLE I didn't see this behavior although the CloudFormation support the "Tags" property on this resource.
I have observed the similar behavior to some more resource types like "AWS::ElasticLoadBalancingV2::LoadBalancer".
### Test Cases
Try using the below sample template for role creation:
```
AWSTemplateFormatVersion: 2010-09-09
Description: IAM Roles Stack
Resources:
Role:
Type: 'AWS::IAM::Role'
Properties:
Path: /
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- iot.amazonaws.com
Action:
- 'sts:AssumeRole'
MaxSessionDuration: 3600
```
Once the role is created; review the Tags section of the role in IAM console; you won't be seeing the below tags as expected:
1. aws:cloudformation:logical-id
2. aws:cloudformation:stack-id
3. aws:cloudformation:stack-name
### Other Details
_No response_
Contributor guide
Research direction
Start with the sample CloudFormation template in the issue and inspect the created AWS::IAM::Role in the IAM console. Compare the observed Tags with the three documented CloudFormation default tags; done means the inconsistency is resolved or the supported behavior is clearly documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 25/100