aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::ElasticBeanstalk::Application - [BUG] - ResourceLifecycleConfig property ServiceRole attribute accepts role name and fails but ARN is required

Open
#2,293 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ElasticBeanstalk::Application

### Resource Name

_No response_

### Issue Description

The CloudFormation `AWS::ElasticBeanstalk::Application` `ResourceLifecycleConfig` property allows a `ServiceRole` attribute to be defined. A ARN is required, as defined in the document [1].

If the ARN is not defined correctly e.g. if the role name is defined, CloudFormation will attempt to create the application using the Elastic Beanstalk `CreateApplication` API which fails with the a CloudFormation event error message `Resource handler returned message: "Access denied for operation 'AWS::ElasticBeanstalk::Application'." `

The Elastic Beanstalk CreateApplication API fails with;
```
"errorCode": "InsufficientPrivilegesException",
"errorMessage": "Insufficient privileges for IAM PassRole Action."
```

Please implement a validation check for the `ServiceRole` attribute to ensure this value conforms with the expected ARN format before CloudFormation attempts to call the Elastic Beanstalk `CreateApplication` API and return appropriate error message.

[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-elasticbeanstalk-application-applicationresourcelifecycleconfig.html#cfn-elasticbeanstalk-application-applicationresourcelifecycleconfig-servicerole

### Expected Behavior

If the ARN is not defined for the `ServiceRole` correctly e.g. if the role name is defined, appropriate error message returned by CloudFormation without executing the Elastic Beanstalk `CreateApplication` API.

### Observed Behavior

If the ARN is not defined for the `ServiceRole` correctly e.g. if the role name is defined, CloudFormation will execute the Elastic Beanstalk `CreateApplication` API which fails.

### Test Cases

Example CloudFormation template attached.

[example.yaml.txt](https://github.com/user-attachments/files/19643031/example.yaml.txt)

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the attached example.yaml.txt and the documented ServiceRole requirement, then trace the AWS::ElasticBeanstalk::Application ResourceLifecycleConfig handling. Verify that an invalid role name is rejected before the CreateApplication API call and that the resulting error is appropriate.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.