aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::ServiceCatalog::Portfolio] - [BUG] - Issue with handling principals with IAM paths
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::ServiceCatalog::Portfolio
### Resource Name
_No response_
### Issue Description
When using AWS::ServiceCatalog::PortfolioPrincipalAssociation with IAM principals that have a path, CloudFormation successfully creates the association but fails to delete it during stack deletion, causing stack deletion to fail with the error: "DELETE_FAILED **Portfolio port-abcd still has associated Principals**".
Template used for issue replication:
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
ServiceCatalogRole:
Type: AWS::IAM::Role
Properties:
RoleName: SCTestRole
Path: /test/
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: servicecatalog.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/ReadOnlyAccess
TestPortfolio:
Type: AWS::ServiceCatalog::Portfolio
Properties:
DisplayName: TestPortfolio
ProviderName: TestProvider
Description: Test portfolio
TestProduct:
Type: AWS::ServiceCatalog::CloudFormationProduct
Properties:
Name: TestProduct
Owner: TestOwner
ProvisioningArtifactParameters:
- Name: v1.0
Info:
LoadTemplateFromURL: https://s3.amazonaws.com/cloudformation-templates-us-east-1/S3_Bucket.template
Type: CLOUD_FORMATION_TEMPLATE
ProductAssociation:
Type: AWS::ServiceCatalog::PortfolioProductAssociation
Properties:
PortfolioId: !Ref TestPortfolio
ProductId: !Ref TestProduct
PrincipalAssociation:
Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
Properties:
PortfolioId: !Ref TestPortfolio
PrincipalARN: !Sub 'arn:aws:iam::${AWS::AccountId}:role/SCTestRole'
PrincipalType: IAM
```
However, when using Principals without IAM paths, disassociation and deletion of resources goes seamless.
The only workaround for now is to manually detach the principal or use custom resources.
### Expected Behavior
Expecting the disassociation operation to succeed the same way as Principal with IAM paths.
### Observed Behavior
Stack deletion fails with:
**Resource handler returned message: "Portfolio port-abcd still has associated Principals (Service: AWSServiceCatalog; Status Code: 400; Error Code: ResourceInUseException;**
### Test Cases
Pass the following role as a principal "arn:aws:iam::ACCOUNT_ID:role/test/SCTestRole" instead of "arn:aws:iam::ACCOUNT_ID:role/SCTestRole"
### Other Details
_No response_
Contributor guide
Research direction
Start by reproducing the AWS::ServiceCatalog::PortfolioPrincipalAssociation case from the supplied CloudFormation template, using an IAM role with the /test/ path, then compare it with the no-path ARN case. Done means the path-bearing principal is disassociated successfully and stack deletion completes without the ResourceInUseException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100