aws / aws/aws-cdk

elastic beanstalk: IamInstanceProfile option fails to accept cdk created role

Open
#28,353 3 comments 0 reactions 1 assignee Claimed by @gracelu0 View on GitHub
@aws-cdk/aws-iam bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

when creating a role in cdk and then trying to attach said newly created role to elastic beanstalk it fails with: 'AWS::ElasticBeanstalk::Environment' with identifier '...' did not stabilize." On the other hand when attaching an existing role it works.

### Expected Behavior

Should be able to assign newly created role to elasticbeanstalk

### Current Behavior

> Resource handler returned message: "Resource of type 'AWS::ElasticBeanstalk::Environment' with identifier 'preprod-DotnetElasticBeanstalkEnv' did not stabilize." (RequestToken: 74a03b50-13e9-e182-ba7c-09a039b04887, HandlerErrorCode: NotStabilized)

### Reproduction Steps

Example Code:

```ts
export function createElasticBeanstalkRole(scope:Construct, stage:Stage, configSecretURN:string, CognitoURN:string, fileBucketURN:string){
// Create an IAM role for Elastic Beanstalk

const ebRole = new Role(scope, 'dev-elasticbeanstalk-ec2-rol') , {
assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
roleName: 'dev-elasticbeanstalk-ec2-rol'
});

// some managed policies eb must have
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWebTier'));
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkMulticontainerDocker'));
ebRole.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('AWSElasticBeanstalkWorkerTier'));

//Custom policies
//access to config secrets

// Attach policies granting necessary permissions for SecretConfig
ebRole.addToPrincipalPolicy(new PolicyStatement({
actions: [
'secretsmanager:GetSecretValue',
],
resources: [configSecretURN],



const elasticbeanstalkSecurityGroup = new SecurityGroup(scope, GetConstructId(stage, `elasticBeanstalkSG`), {
securityGroupName:GetConstructId(stage, `elasticBeanstalkSG`),
vpc: vpc,
allowAllOutbound: true,
});


// Define your Elastic Beanstalk application and environment
const application = new elasticbeanstalk.CfnApplication(
scope,
GetConstructId(stage, "ElasticBeanStalk"),
{
applicationName: GetConstructId(stage, "DotnetElasticBeanstalkApp"),
}
);

const environment = new elasticbeanstalk.CfnEnvironment(
scope,
GetConstructId(stage, "ElasticBeanStalkEnv"),
{
applicationName: application.applicationName!,
environmentName: GetConstructId(stage,"DotnetElasticBeanstalkEnv"),
solutionStackName: "64bit Amazon Linux 2023 v3.0.1 running .NET 6",

optionSettings: [
//other options ...
{
namespace: "aws:autoscaling:launchconfiguration",
optionName: "IamInstanceProfile",
value: roleARN, //elasticbeanstalk-ec2-rol
}
]

}));

```

It fails with both role name and roleArn.
However when provided with existing role name it succeeds

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.79.1

### Framework Version

_No response_

### Node.js Version

v18.16.0

### OS

Windows 10

### Language

TypeScript

### Language Version

4.3.5

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.