aws / aws/containers-roadmap

[Batch] [request]: Accidental deletion of AWSServiceRoleForBatch

Open
#2,032 0 comments 0 reactions 0 assignees View on GitHub
Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
What do you want us to build?

AWS Batch service role is created for you automatically in the console first-run experience.

**Which service(s) is this request for?**
AWS Batch

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

Currently, AWS Batch service role is created for you automatically in the console first-run experience. If this role is created by AWS then it should not allow users to delete the role as well like we have for AWS managed IAM policies. This will ensure that service role which are required for proper functioning of the service are not deleted accidentally causing issues with Batch.

**Are you currently working around this issue?**

If you delete this service-linked role, and then need to create it again, you can use the same process to recreate the role in your account. When you CreateComputeEnvironment, AWS Batch creates the service-linked role for you again.

We are trying to create a new role with same name however a user can't create a service role directly and has to create a compute environment which then creates a role. So, the ask is when they can't create this role they should not be able to delete it accidentally as well.

Contributor guide

Open the contributing guide

Research direction

Review the AWS Batch console first-run flow and the CreateComputeEnvironment process described in the issue. Determine how the AWSServiceRoleForBatch service-linked role can be protected from accidental deletion while still allowing the documented recreation path. Done means the requested deletion protection behavior is defined and validated for AWS Batch users.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.