aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::IAM::Role resources don’t receive the aws:cloudformation built-in tags
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::Role
### Issue Description
When you have an `AWS::IAM::Role` resource in your stack, it does not get assigned the built-in tags: `aws:cloudformation:stack-name`, `aws:cloudformation:logical-id` and `aws:cloudformation:stack-id`
This happens both for roles specified directly in the template and in roles added by the AWS::Serverless transform.
### Expected Behavior
All stack resources should automatically receive the aws:cloudformation:* built-in tags.
### Observed Behavior
No tags are added automatically to AWS::IAM::Role resources.
### Test Cases
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
BasicLambdaFunctionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- sts:AssumeRole
Principal:
Service:
- lambda.amazonaws.com
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
- arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
- arn:aws:iam::aws:policy/AWSLambda_ReadOnlyAccess
- arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
```
Contributor guide
Research direction
Start by reproducing the supplied AWS::IAM::Role template and check whether the three aws:cloudformation:* tags are present. Repeat with a role created by the AWS::Serverless transform. The issue is complete when both direct and transformed roles receive stack-name, logical-id, and stack-id tags.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100