aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::ServiceCatalog::Portfolio] - [BUG] - Issue with handling principals with IAM paths

Open
#2,430 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::ServiceCatalog::Portfolio

### Resource Name

_No response_

### Issue Description

When using AWS::ServiceCatalog::PortfolioPrincipalAssociation with IAM principals that have a path, CloudFormation successfully creates the association but fails to delete it during stack deletion, causing stack deletion to fail with the error: "DELETE_FAILED **Portfolio port-abcd still has associated Principals**".

Template used for issue replication:
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
ServiceCatalogRole:
Type: AWS::IAM::Role
Properties:
RoleName: SCTestRole
Path: /test/
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: servicecatalog.amazonaws.com
Action: sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/ReadOnlyAccess

TestPortfolio:
Type: AWS::ServiceCatalog::Portfolio
Properties:
DisplayName: TestPortfolio
ProviderName: TestProvider
Description: Test portfolio

TestProduct:
Type: AWS::ServiceCatalog::CloudFormationProduct
Properties:
Name: TestProduct
Owner: TestOwner
ProvisioningArtifactParameters:
- Name: v1.0
Info:
LoadTemplateFromURL: https://s3.amazonaws.com/cloudformation-templates-us-east-1/S3_Bucket.template
Type: CLOUD_FORMATION_TEMPLATE

ProductAssociation:
Type: AWS::ServiceCatalog::PortfolioProductAssociation
Properties:
PortfolioId: !Ref TestPortfolio
ProductId: !Ref TestProduct

PrincipalAssociation:
Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
Properties:
PortfolioId: !Ref TestPortfolio
PrincipalARN: !Sub 'arn:aws:iam::${AWS::AccountId}:role/SCTestRole'
PrincipalType: IAM
```

However, when using Principals without IAM paths, disassociation and deletion of resources goes seamless.

The only workaround for now is to manually detach the principal or use custom resources.

### Expected Behavior

Expecting the disassociation operation to succeed the same way as Principal with IAM paths.

### Observed Behavior

Stack deletion fails with:
**Resource handler returned message: "Portfolio port-abcd still has associated Principals (Service: AWSServiceCatalog; Status Code: 400; Error Code: ResourceInUseException;**

### Test Cases

Pass the following role as a principal "arn:aws:iam::ACCOUNT_ID:role/test/SCTestRole" instead of "arn:aws:iam::ACCOUNT_ID:role/SCTestRole"

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the AWS::ServiceCatalog::PortfolioPrincipalAssociation case from the supplied CloudFormation template, using an IAM role with the /test/ path, then compare it with the no-path ARN case. Done means the path-bearing principal is disassociated successfully and stack deletion completes without the ResourceInUseException.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.