aws / aws/aws-toolkit-azure-devops
Timeout of CreateOrUpdateStackTask defaults to 15 minutes when OIDC is used
- Dominant language
- TypeScript
- Stars
- 258
- Forks
- 114
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
When using OIDC to authenticate the _CloudFormationCreateOrUpdateStack_ task, the default timeout for stack creation drops to 15 minutes (instead of 60).
**To reproduce**
1. Configure an AWS Service connection in Azure DevOps to use OIDC
2. Run a pipeline with _CloudFormationCreateOrUpdateStack_ task. Use a stack that takes a long time to deploy (e.g. MSK Clusters, RDS databases, DMS instances, etc., anything that takes more than 15 minutes to deploy).
3. The stack is created and begins to deploy. This takes a long time, as expected (due to the resource, which takes a long time to deploy).
4. After ~15 minutes, the task reports that the stack failed to reach completion status, throws and error and halts the pipeline.
5. The CloudFormation stack continues to deploy without issues, and eventually completes the deployment successfully (albeit after 30-40+ minutes).
**Expected behavior**
As per [the documentation](https://docs.aws.amazon.com/vsts/latest/userguide/cloudformation-create-update.html#:~:text=By%20default%20a%20maximum%20of%2060%20minutes%20is%20used), a default timeout of 60 minutes should be used to wait until stack finishes deployment, before the pipeline task throws an error. This is the case if IAM Credentials are used in the Service Connection.
**Screenshots**
Not applicable
**Your Environment**
- On-prem or cloud based: Cloud Based Azure DevOps service
- Azure DevOps version: `Version Dev19.M243.1 (AzureDevOps_M243_20240823.6)`
- AWS Toolkit for Azure DevOps version: `1.15.0`
**Additional context**
Related to #521
Contributor guide
Research direction
Start from the CloudFormationCreateOrUpdateStack task and reproduce the OIDC pipeline with a deployment lasting more than 15 minutes. Compare its default wait timeout with the IAM Credentials path and the documented 60-minute behavior. Done means OIDC-authenticated runs wait up to 60 minutes before reporting a timeout, while the existing reproduction completes successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100