aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::Organizations::ResourcePolicy] - [BUG] - CREATE fails due to eventual consistency race condition
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::Organizations::ResourcePolicy
### Resource Name
_No response_
### Issue Description
When creating an AWS::Organizations::ResourcePolicy resource, CloudFormation intermittently fails with ResourcePolicyNotFoundException because the resource handler attempts to read the policy immediately after creation, before AWS has propagated the resource.
CloudFormation error (misleading):
`CREATE_FAILED | AWS::Organizations::ResourcePolicy | Policy
Resource handler returned message: "You don't have permissions to access this resource.
(Service: Organizations, Status Code: 400, Request ID: xxx)"
(HandlerErrorCode: AccessDenied)`
### Expected Behavior
CloudFormation should implement stabilization/retry logic for the read operation after creating the resource, similar to how other resources handle eventual consistency (e.g., IAM roles, ECS services).
The resource handler should:
- Retry the read operation with exponential backoff
- Wait for the resource to be consistently available before returning CREATE_COMPLETE
### Observed Behavior
- CloudFormation calls PutResourcePolicy API - succeeds
- CloudFormation immediately calls read/describe to verify creation (the same second)
- Read fails due to eventual consistency
- Stack creation fails and rolls back
Here is the CloudTrail from the events:
Put event:
```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": "PRINCIPALID:policy-2222222222",
"arn": "arn:aws:sts::123456789011:assumed-role/ROLENAME/session-15",
"accountId": "123456789011",
"accessKeyId": "ACCESSKEYID",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "PRINCIPALID",
"arn": "arn:aws:iam::123456789011:role/ROLENAME",
"accountId": "123456789011",
"userName": "ROLENAME"
},
"webIdFederationData": {
"federatedProvider": "arn:aws:iam::123456789011:oidc-provider/OIDC",
"attributes": {}
},
"attributes": {
"creationDate": "2025-12-18T14:31:09Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2025-12-18T14:31:41Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "PutResourcePolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"requestParameters": {
"content": "HIDDEN_DUE_TO_SECURITY_REASONS",
"tags": []
},
"responseElements": {
"resourcePolicy": {
"resourcePolicySummary": {
"id": "RESOURCEPOLICY",
"arn": "arn:aws:organizations::123456789011:resourcepolicy/o-aaaaa11111/r-aaaaaaa"
},
"content": "HIDDEN_DUE_TO_SECURITY_REASONS"
}
},
"requestID": "7a00ba3b-385d-4721-b038-5a27a2aef7e4",
"eventID": "48c260a8-babe-4033-a62f-a390a1e0cae4",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789011",
"eventCategory": "Management"
}
```
Read Event:
```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": "PRINCIPALID:session-15",
"arn": "arn:aws:sts::123456789011:assumed-role/ROLENAME/session-15",
"accountId": "123456789011",
"accessKeyId": "ACCESSKEYID",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "PRINCIPALID",
"arn": "arn:aws:iam::123456789011:role/ROLENAME",
"accountId": "123456789011",
"userName": "ROLENAME"
},
"webIdFederationData": {
"federatedProvider": "arn:aws:iam::123456789011:oidc-provider/OIDC",
"attributes": {}
},
"attributes": {
"creationDate": "2025-12-18T14:31:09Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2025-12-18T14:31:41Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "DescribeResourcePolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"errorCode": "ResourcePolicyNotFoundException",
"errorMessage": "No resource-based policy found.",
"requestParameters": null,
"responseElements": null,
"requestID": "043c64f8-da75-421d-b079-62ad869af5b7",
"eventID": "248e49d2-d05d-4a69-9504-c23d7dec3220",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789011",
"eventCategory": "Management"
}
```
### Test Cases
Deploy a resource policy with CloudFormation.
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::Organizations::ResourcePolicy create and read/stabilization handlers, then compare the existing IAM role and ECS service consistency handling referenced in the issue. Reproduce by deploying a resource policy and inspect the PutResourcePolicy and DescribeResourcePolicy sequence. Done means transient ResourcePolicyNotFoundException responses are retried with backoff and creation reaches CREATE_COMPLETE after the policy is available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100