aws / aws/aws-cli

`aws iam wait role-exists` does not guarantee that it is assumable by Lambda

Open
#7,700 5 comments 0 reactions 0 assignees View on GitHub
feature-request iam p3
Dominant language
Python
Stars
17.3k
Forks
4.6k
Avg merge
1d 2h
Merged PRs (30d)
13

Description

### Describe the bug

I used `aws iam create-role` to create a role for `aws lambda create-function` and found the role is not (yet) assumable.
So I use `aws iam wait role-exists` to wait for the role to be created.
But even if `aws iam wait role-exists` returns successfully, it cannot be assumed by Lambda instantly.
A simple `sleep 5` works for me but it seems unreliable.
This may not be a bug but we need a way to ensure a role is usable by Lambda.

### Expected Behavior

When `aws iam wait role-exists` returns successfully, the role should be assumable.

### Current Behavior

Even if `aws iam wait role-exists` returns successfully, the role still cannot be assumed by Lambda, showing the following error:
```sh
An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.
```

### Reproduction Steps

1. Pull [the repo](https://github.com/zetaraku/hello-aws-lambda-zip), switch to the `issue-repro` branch, and install the dependencies:

```sh
git clone git@github.com:zetaraku/hello-aws-lambda-zip.git
cd hello-aws-lambda-zip
git switch issue-repro
npm install
```

2. Create the role and function:
```sh
npm run init
```

3. Before trying again, run the script to delete the created role and function:
```sh
npm run deinit
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CLI version used

2.4.28

### Environment details (OS name and version, etc.)

Python/3.8.8 Windows/10 exe/AMD64 prompt/off

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.