Add ECS Service Linked Role to sandbox accounts #49
Conversation
Ensures ECS clusters can be created in the sandbox account without permission issues by adding the ECS service-linked role to the Nuke configuration. This prevents Nuke from deleting the role and causing issues when creating ECS clusters.
Simplifies the creation of the ECS service-linked role by using `CfnServiceLinkedRole` instead of manually defining the role and its policies. This change also removes unnecessary suppressions for cfn-guard, as the `CfnServiceLinkedRole` doesn't support `cfnOptions`. The nuke config is also updated to reflect the changes.
|
Hi @aws-khargita ! |
|
Help needed |
| - property: RoleName | ||
| type: glob | ||
| value: aws-controltower-* | ||
| IAMServiceLinkedRole: |
There was a problem hiding this comment.
Unfortunately this will cause any customizations to the nuke configuration to be rolled back on update. This is how CloudFormation behaves with the HostedConfiguration resource.
We are planning on making some changes to preserve any customizations in the configuration files while still allowing updates like this, but unfortunately we can not merge this in it's current state.
Sorry for the inconvenience, we will get this sorted out in the future.
|
Hi, I appreciate you opening this pull request. Unfortunately, the change to the nuke config will result in the AppConfig configuration being rolled back to the default content on stack update, which may cause issues for users updating the solution. We are planning to address this upgrade issue in the next release, where we can hopefully incorporate this change. In the meantime, if you are deploying from source, the changes made here should allow for the creation of ECS clusters. Apologies for any inconvenience. |
3 participants
Summary
Adds ECS Service Linked Role (
AWSServiceRoleForECS) to sandbox account resources to resolve ECS cluster creation failuresChanges
CfnServiceLinkedRolefor ECS service inIsbSandboxAccountResourcesIAMServiceLinkedRolein nuke-config.yamlProblem Solved
Fixes "Unable to assume the service linked role" error when creating ECS clusters in sandbox accounts.
Testing