aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

aws_iam: CfnServiceLinkedRole not adding policy to role

Open
#1,800 0 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::ServiceLinkedRole

### Resource Name

_No response_

### Issue Description

I made an issue [#27203](https://github.com/aws/aws-cdk/issues/27203) in the aws-cdk github repo but they told me this was a more appropriate place to report.

When creating a lexv2 bot with a built-in intent type of AMAZON.KendraSearchIntent a policy with permissions to query Kendra should be generated but it isn't. The policy is automatically generated and attached to the service linked role in the AWS console but it is not added if the bot is created though the cdk (and therefore cloudformation).

In the CfnServiceLinkedRole docs it says:
To attach a policy to this service-linked role, you must make the request using the AWS service that depends on this role.

Lex doesn't have any provisions for modifying service linked roles that I see, it says in the service linked role docs for lex that if a bot is configured to use the KendraSearchIntent intent then the service linked role should allow the actions for the specified resource.

Link to CfnServiceLinkedRole docs: https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_iam/CfnServiceLinkedRole.html

Link to LexV2 Service linked role docs: https://docs.aws.amazon.com/lexv2/latest/dg/using-service-linked-roles.html

Relevant cdk code snippet:
```
lex_role = iam.CfnServiceLinkedRole(
self,
"Lex Role",
aws_service_name="lexv2.amazonaws.com",
description="Service Linked Role for Lex Bots deployed by cdk stack",
custom_suffix="test",
)

menu_bot = lex.CfnBot(
self,
"Menu Bot",
data_privacy={"ChildDirected": False},
idle_session_ttl_in_seconds=60,
name="MenuBot",
role_arn=f"arn:aws:iam::{account}:role/aws-service-role/lexv2.amazonaws.com/{lex_role.attr_role_name}",
bot_locales=[
lex.CfnBot.BotLocaleProperty(
locale_id="en_US",
description="Locale for Kendra",
nlu_confidence_threshold=0.90,
intents=[
lex.CfnBot.IntentProperty(
name="RequiredIntent",
description="Intent required for bot to build",
sample_utterances=[
lex.CfnBot.SampleUtteranceProperty(
utterance="Do not use this ever"
)
],
),
lex.CfnBot.IntentProperty(
name="KendraSearchIntent",
description="Intent to ask a question. This intent searches a Kendra index for an answer to the question.",
kendra_configuration=lex.CfnBot.KendraConfigurationProperty(
kendra_index=kendra_index.attr_arn,
),
parent_intent_signature="AMAZON.KendraSearchIntent",
fulfillment_code_hook=lex.CfnBot.FulfillmentCodeHookSettingProperty(
enabled=False,
is_active=True,
post_fulfillment_status_specification=lex.CfnBot.PostFulfillmentStatusSpecificationProperty(
success_response=lex.CfnBot.ResponseSpecificationProperty(
allow_interrupt=True,
message_groups_list=[
lex.CfnBot.MessageGroupProperty(
message=lex.CfnBot.MessageProperty(
plain_text_message=lex.CfnBot.PlainTextMessageProperty(
value="I found a link to a document that could help you: ((x-amz-lex:kendra-search-response-document-link-1"
)
),
)
],
)
),
),
),
lex.CfnBot.IntentProperty(
name="FallbackIntent",
description="Default intent when no other intent matches",
parent_intent_signature="AMAZON.FallbackIntent",
),
],
)
],
auto_build_bot_locales=True,
description="Draft Version",
bot_tags=[env_tag, project_tag],
)
```

### Expected Behavior

A policy allowing access to Kendra from Lex should be generated so lex can use the built-in AMAZON.KendraSearchIntent intent.

### Observed Behavior

The policy is not generated, access is blocked
![image](https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/assets/70229357/f2fd56ce-caa0-4069-9518-29227eb8cb3c)

### Test Cases

Create Lex bot with AMAZON.KendraSearchIntent, test the bot and it should have permissions to access Kendra.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the CfnServiceLinkedRole and CfnBot configuration shown in the issue, using the linked AWS IAM and Lex V2 service-linked-role documentation. Verify whether creating a bot with AMAZON.KendraSearchIntent through CloudFormation produces the Kendra permissions seen in the console. Done means the deployed Lex bot can query the specified Kendra index without access being blocked.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authorization, cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.