elastic beanstalk: IamInstanceProfile option fails to accept cdk created role
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
when creating a role in cdk and then trying to attach said newly created role to elastic beanstalk it fails with: 'AWS::ElasticBeanstalk::Environment' with identifier '...' did not stabilize." On the other hand when attaching an existing role it works.
### Expected Behavior
Should be able to assign newly created role to elasticbeanstalk
### Current Behavior
> Resource handler returned message: "Resource of type 'AWS::ElasticBeanstalk::Environment' with identifier 'preprod-DotnetElasticBeanstalkEnv' did not stabilize." (RequestToken: 74a03b50-13e9-e182-ba7c-09a039b04887, HandlerErrorCode: NotStabilized)
### Reproduction Steps
Example Code:
```ts
export function createElasticBeanstalkRole(scope:Construct, stage:Stage, configSecretURN:string, CognitoURN:string, fileBucketURN:string){
// Create an IAM role for Elastic Beanstalk
const ebRole = new Role(scope, 'dev-elasticbeanstalk-ec2-rol') , {
assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
roleName: 'dev-elasticbeanstalk-ec2-rol'
});
// some managed policies eb must have
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWebTier'));
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkMulticontainerDocker'));
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWorkerTier'));
//Custom policies
//access to config secrets
// Attach policies granting necessary permissions for SecretConfig
ebRole.addToPrincipalPolicy(new PolicyStatement({
actions: [
'secretsmanager:GetSecretValue',
],
resources: [configSecretURN],
const elasticbeanstalkSecurityGroup = new SecurityGroup(scope, GetConstructId(stage, `elasticBeanstalkSG`), {
securityGroupName:GetConstructId(stage, `elasticBeanstalkSG`),
vpc: vpc,
allowAllOutbound: true,
});
// Define your Elastic Beanstalk application and environment
const application = new elasticbeanstalk.CfnApplication(
scope,
GetConstructId(stage, "ElasticBeanStalk"),
{
applicationName: GetConstructId(stage, "DotnetElasticBeanstalkApp"),
}
);
const environment = new elasticbeanstalk.CfnEnvironment(
scope,
GetConstructId(stage, "ElasticBeanStalkEnv"),
{
applicationName: application.applicationName!,
environmentName: GetConstructId(stage,"DotnetElasticBeanstalkEnv"),
solutionStackName: "64bit Amazon Linux 2023 v3.0.1 running .NET 6",
optionSettings: [
//other options ...
{
namespace: "aws:autoscaling:launchconfiguration",
optionName: "IamInstanceProfile",
value: roleARN, //elasticbeanstalk-ec2-rol
}
]
}));
```
It fails with both role name and roleArn.
However when provided with existing role name it succeeds
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.79.1
### Framework Version
_No response_
### Node.js Version
v18.16.0
### OS
Windows 10
### Language
TypeScript
### Language Version
4.3.5
### Other information
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.