aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::Organizations::ResourcePolicy] - [BUG] - CREATE fails due to eventual consistency race condition

Open
#2,440 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::Organizations::ResourcePolicy

### Resource Name

_No response_

### Issue Description

When creating an AWS::Organizations::ResourcePolicy resource, CloudFormation intermittently fails with ResourcePolicyNotFoundException because the resource handler attempts to read the policy immediately after creation, before AWS has propagated the resource.

CloudFormation error (misleading):
`CREATE_FAILED | AWS::Organizations::ResourcePolicy | Policy
Resource handler returned message: "You don't have permissions to access this resource.
(Service: Organizations, Status Code: 400, Request ID: xxx)"
(HandlerErrorCode: AccessDenied)`

### Expected Behavior

CloudFormation should implement stabilization/retry logic for the read operation after creating the resource, similar to how other resources handle eventual consistency (e.g., IAM roles, ECS services).
The resource handler should:

- Retry the read operation with exponential backoff
- Wait for the resource to be consistently available before returning CREATE_COMPLETE

### Observed Behavior

- CloudFormation calls PutResourcePolicy API - succeeds
- CloudFormation immediately calls read/describe to verify creation (the same second)
- Read fails due to eventual consistency
- Stack creation fails and rolls back

Here is the CloudTrail from the events:

Image

Put event:
```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": "PRINCIPALID:policy-2222222222",
"arn": "arn:aws:sts::123456789011:assumed-role/ROLENAME/session-15",
"accountId": "123456789011",
"accessKeyId": "ACCESSKEYID",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "PRINCIPALID",
"arn": "arn:aws:iam::123456789011:role/ROLENAME",
"accountId": "123456789011",
"userName": "ROLENAME"
},
"webIdFederationData": {
"federatedProvider": "arn:aws:iam::123456789011:oidc-provider/OIDC",
"attributes": {}
},
"attributes": {
"creationDate": "2025-12-18T14:31:09Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2025-12-18T14:31:41Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "PutResourcePolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"requestParameters": {
"content": "HIDDEN_DUE_TO_SECURITY_REASONS",
"tags": []
},
"responseElements": {
"resourcePolicy": {
"resourcePolicySummary": {
"id": "RESOURCEPOLICY",
"arn": "arn:aws:organizations::123456789011:resourcepolicy/o-aaaaa11111/r-aaaaaaa"
},
"content": "HIDDEN_DUE_TO_SECURITY_REASONS"
}
},
"requestID": "7a00ba3b-385d-4721-b038-5a27a2aef7e4",
"eventID": "48c260a8-babe-4033-a62f-a390a1e0cae4",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789011",
"eventCategory": "Management"
}
```
Read Event:

```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AssumedRole",
"principalId": "PRINCIPALID:session-15",
"arn": "arn:aws:sts::123456789011:assumed-role/ROLENAME/session-15",
"accountId": "123456789011",
"accessKeyId": "ACCESSKEYID",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "PRINCIPALID",
"arn": "arn:aws:iam::123456789011:role/ROLENAME",
"accountId": "123456789011",
"userName": "ROLENAME"
},
"webIdFederationData": {
"federatedProvider": "arn:aws:iam::123456789011:oidc-provider/OIDC",
"attributes": {}
},
"attributes": {
"creationDate": "2025-12-18T14:31:09Z",
"mfaAuthenticated": "false"
}
},
"invokedBy": "cloudformation.amazonaws.com"
},
"eventTime": "2025-12-18T14:31:41Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "DescribeResourcePolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "cloudformation.amazonaws.com",
"userAgent": "cloudformation.amazonaws.com",
"errorCode": "ResourcePolicyNotFoundException",
"errorMessage": "No resource-based policy found.",
"requestParameters": null,
"responseElements": null,
"requestID": "043c64f8-da75-421d-b079-62ad869af5b7",
"eventID": "248e49d2-d05d-4a69-9504-c23d7dec3220",
"readOnly": true,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789011",
"eventCategory": "Management"
}
```

### Test Cases

Deploy a resource policy with CloudFormation.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::Organizations::ResourcePolicy create and read/stabilization handlers, then compare the existing IAM role and ECS service consistency handling referenced in the issue. Reproduce by deploying a resource policy and inspect the PutResourcePolicy and DescribeResourcePolicy sequence. Done means transient ResourcePolicyNotFoundException responses are retried with backoff and creation reaches CREATE_COMPLETE after the policy is available.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.