aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::ElasticBeanstalk::Application - [BUG] - ResourceLifecycleConfig property ServiceRole attribute accepts role name and fails but ARN is required
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::ElasticBeanstalk::Application
### Resource Name
_No response_
### Issue Description
The CloudFormation `AWS::ElasticBeanstalk::Application` `ResourceLifecycleConfig` property allows a `ServiceRole` attribute to be defined. A ARN is required, as defined in the document [1].
If the ARN is not defined correctly e.g. if the role name is defined, CloudFormation will attempt to create the application using the Elastic Beanstalk `CreateApplication` API which fails with the a CloudFormation event error message `Resource handler returned message: "Access denied for operation 'AWS::ElasticBeanstalk::Application'." `
The Elastic Beanstalk CreateApplication API fails with;
```
"errorCode": "InsufficientPrivilegesException",
"errorMessage": "Insufficient privileges for IAM PassRole Action."
```
Please implement a validation check for the `ServiceRole` attribute to ensure this value conforms with the expected ARN format before CloudFormation attempts to call the Elastic Beanstalk `CreateApplication` API and return appropriate error message.
[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticbeanstalk-application-applicationresourcelifecycleconfig.html#cfn-elasticbeanstalk-application-applicationresourcelifecycleconfig-servicerole
### Expected Behavior
If the ARN is not defined for the `ServiceRole` correctly e.g. if the role name is defined, appropriate error message returned by CloudFormation without executing the Elastic Beanstalk `CreateApplication` API.
### Observed Behavior
If the ARN is not defined for the `ServiceRole` correctly e.g. if the role name is defined, CloudFormation will execute the Elastic Beanstalk `CreateApplication` API which fails.
### Test Cases
Example CloudFormation template attached.
[example.yaml.txt](https://github.com/user-attachments/files/19643031/example.yaml.txt)
### Other Details
_No response_
Contributor guide
Research direction
Start with the attached example.yaml.txt and the documented ServiceRole requirement, then trace the AWS::ElasticBeanstalk::Application ResourceLifecycleConfig handling. Verify that an invalid role name is rejected before the CreateApplication API call and that the resulting error is appropriate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100