`aws iam wait role-exists` does not guarantee that it is assumable by Lambda
- Dominant language
- Python
- Stars
- 17.3k
- Forks
- 4.6k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 13
Description
### Describe the bug
I used `aws iam create-role` to create a role for `aws lambda create-function` and found the role is not (yet) assumable.
So I use `aws iam wait role-exists` to wait for the role to be created.
But even if `aws iam wait role-exists` returns successfully, it cannot be assumed by Lambda instantly.
A simple `sleep 5` works for me but it seems unreliable.
This may not be a bug but we need a way to ensure a role is usable by Lambda.
### Expected Behavior
When `aws iam wait role-exists` returns successfully, the role should be assumable.
### Current Behavior
Even if `aws iam wait role-exists` returns successfully, the role still cannot be assumed by Lambda, showing the following error:
```sh
An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.
```
### Reproduction Steps
1. Pull [the repo](https://github.com/zetaraku/hello-aws-lambda-zip), switch to the `issue-repro` branch, and install the dependencies:
```sh
git clone git@github.com:zetaraku/hello-aws-lambda-zip.git
cd hello-aws-lambda-zip
git switch issue-repro
npm install
```
2. Create the role and function:
```sh
npm run init
```
3. Before trying again, run the script to delete the created role and function:
```sh
npm run deinit
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CLI version used
2.4.28
### Environment details (OS name and version, etc.)
Python/3.8.8 Windows/10 exe/AMD64 prompt/off
Contributor guide
Assessment
This issue has not been assessed yet.