aws / aws/aws-sam-cli

sam pipeline do not support sam delete <stack_name> script with --role-arn option[ISSUE with the roles]

Open
#3,411 1 comment 0 reactions 0 assignees View on GitHub
area/pipeline stage/bug-repro
Dominant language
Python
Stars
6.7k
Forks
1.2k
Avg merge
1d 10h
Merged PRs (30d)
52

Description

### Description:

While setting up a `gitlab-ci` pipeline, in of my jobs I'm trying to delete a stack using sam delete command, I get an access denied when I try to run as one of the scripts in my job.

### Steps to reproduce:
To test locally, try changing your user to use aws-sam-cli-managed-pipeline-user that sam created while setting up the pipeline using `sam pipeline`, one can follow this guide:
https://aws.amazon.com/blogs/compute/introducing-aws-sam-pipelines-automatically-generate-deployment-pipelines-for-serverless-applications/

Little bit overview about sam pipeline tool, using this tool automates the process of creating roles and user inside AWS and generates gitlab-ci.yml file. It creates two roles and one IAM user - Pipeline execution role and Cloudformation Execution with fullaccess. The pipeline user is also created with sts:assumeRole policy.

script:
sam delete --stack-name $(echo ${CI_COMMIT_REF_NAME} | tr -cd '[a-zA-Z0-9-]') --no-prompts --region ${TESTING_REGION}

### Observed result:

```
2021-10-26 16:27:28,866 | ClientError Exception : An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:XXXX:stack/patchPH-107772/xxx

Error: Failed to delete the stack: sample-stack, An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:XXXX:stack/sample-stack
```

### Expected result:

It should be able to delete stack, since pipeline also created Cloudformation Role with FULL_CF_ACCESS, and currently there is no way to assume role by passing `--role-arn` option since sam delete doesn't supports it

Though, I tried using aws cli tool to delete stack, but it is also unable to assume-role Cloudformation -role that sam pipeline created:
`aws cloudformation delete-stack --stack-name sample-stack --role-arn CF:ROLE:ARN`

Below is the error I get:
```
An error occurred (AccessDenied) when calling the DeleteStack operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: iam:PassRole on resource: arn:aws:iam::XXX:role/aws-sam-cli-managed-dev-p-CloudFormationExecutionR-XXXX
```

### Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: MacOS 11.5.2 & on gitlab Docker image: public.ecr.aws/sam/build-nodejs14.x
2. `sam --version`: 1.33
3. AWS region: us-east-2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.