aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::IAM::ManagedPolicy - ManagedPolicy overwrites existing IAM policy

Open
#931 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::ManagedPolicy

### Resource Name

AWS::IAM::ManagedPolicy

### Issue Description

CloudFormation shows unexpected behavior when creating a `ManagedPolicy` with same `ManagedPolicyName` but different `Path`.

If the `Path` is also the same, stack fails with the expected error i.e. "already exists".

CloudTrail shows error `EntityAlreadyExistsException` in either case.

### Expected Behavior

Stack should fail with "already exists" error

### Observed Behavior

When creating a stack with a managed policy that has the same `ManagedPolicyName` but different `Path` as an existing policy, the stack creates without problem but clicking the physical ID of the policy under `Resources` in CFN console shows "No Entity Found".

### Test Cases

Create a policy using console/cli
Create a policy with the same name but different path using CFN

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the two test cases by creating an existing policy, then creating an AWS::IAM::ManagedPolicy with the same name and a different Path. Check the CloudTrail EntityAlreadyExistsException and the CloudFormation Resources physical ID; done means the stack fails with the expected policy-already-exists error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authorization, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.