aws / aws/aws-toolkit-azure-devops

Timeout of CreateOrUpdateStackTask defaults to 15 minutes when OIDC is used

Open
#563 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
258
Forks
114
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**

When using OIDC to authenticate the _CloudFormationCreateOrUpdateStack_ task, the default timeout for stack creation drops to 15 minutes (instead of 60).

**To reproduce**

1. Configure an AWS Service connection in Azure DevOps to use OIDC
2. Run a pipeline with _CloudFormationCreateOrUpdateStack_ task. Use a stack that takes a long time to deploy (e.g. MSK Clusters, RDS databases, DMS instances, etc., anything that takes more than 15 minutes to deploy).
3. The stack is created and begins to deploy. This takes a long time, as expected (due to the resource, which takes a long time to deploy).
4. After ~15 minutes, the task reports that the stack failed to reach completion status, throws and error and halts the pipeline.
5. The CloudFormation stack continues to deploy without issues, and eventually completes the deployment successfully (albeit after 30-40+ minutes).

**Expected behavior**

As per [the documentation](https://docs.aws.amazon.com/vsts/latest/userguide/cloudformation-create-update.html#:~:text=By%20default%20a%20maximum%20of%2060%20minutes%20is%20used), a default timeout of 60 minutes should be used to wait until stack finishes deployment, before the pipeline task throws an error. This is the case if IAM Credentials are used in the Service Connection.

**Screenshots**

Not applicable

**Your Environment**

- On-prem or cloud based: Cloud Based Azure DevOps service
- Azure DevOps version: `Version Dev19.M243.1 (AzureDevOps_M243_20240823.6)`
- AWS Toolkit for Azure DevOps version: `1.15.0`

**Additional context**

Related to #521

Contributor guide

Open the contributing guide

Research direction

Start from the CloudFormationCreateOrUpdateStack task and reproduce the OIDC pipeline with a deployment lasting more than 15 minutes. Compare its default wait timeout with the IAM Credentials path and the documented 60-minute behavior. Done means OIDC-authenticated runs wait up to 60 minutes before reporting a timeout, while the existing reproduction completes successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.