sam pipeline do not support sam delete <stack_name> script with --role-arn option[ISSUE with the roles]
- Dominant language
- Python
- Stars
- 6.7k
- Forks
- 1.2k
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 52
Description
### Description:
While setting up a `gitlab-ci` pipeline, in of my jobs I'm trying to delete a stack using sam delete command, I get an access denied when I try to run as one of the scripts in my job.
### Steps to reproduce:
To test locally, try changing your user to use aws-sam-cli-managed-pipeline-user that sam created while setting up the pipeline using `sam pipeline`, one can follow this guide:
https://aws.amazon.com/blogs/compute/introducing-aws-sam-pipelines-automatically-generate-deployment-pipelines-for-serverless-applications/
Little bit overview about sam pipeline tool, using this tool automates the process of creating roles and user inside AWS and generates gitlab-ci.yml file. It creates two roles and one IAM user - Pipeline execution role and Cloudformation Execution with fullaccess. The pipeline user is also created with sts:assumeRole policy.
script:
sam delete --stack-name $(echo ${CI_COMMIT_REF_NAME} | tr -cd '[a-zA-Z0-9-]') --no-prompts --region ${TESTING_REGION}
### Observed result:
```
2021-10-26 16:27:28,866 | ClientError Exception : An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:XXXX:stack/patchPH-107772/xxx
Error: Failed to delete the stack: sample-stack, An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:XXXX:stack/sample-stack
```
### Expected result:
It should be able to delete stack, since pipeline also created Cloudformation Role with FULL_CF_ACCESS, and currently there is no way to assume role by passing `--role-arn` option since sam delete doesn't supports it
Though, I tried using aws cli tool to delete stack, but it is also unable to assume-role Cloudformation -role that sam pipeline created:
`aws cloudformation delete-stack --stack-name sample-stack --role-arn CF:ROLE:ARN`
Below is the error I get:
```
An error occurred (AccessDenied) when calling the DeleteStack operation: User: arn:aws:iam::XXXX:user/aws-sam-cli-managed-dev-pipeline-reso-PipelineUser-XXX is not authorized to perform: iam:PassRole on resource: arn:aws:iam::XXX:role/aws-sam-cli-managed-dev-p-CloudFormationExecutionR-XXXX
```
### Additional environment details (Ex: Windows, Mac, Amazon Linux etc)
1. OS: MacOS 11.5.2 & on gitlab Docker image: public.ecr.aws/sam/build-nodejs14.x
2. `sam --version`: 1.33
3. AWS region: us-east-2
Contributor guide
Assessment
This issue has not been assessed yet.