0

I'm creating a cloudformation resource using the cloudformation cli tool. However I'm having trouble with my DELETE action.

In my create action I am creating a bucket:

s3 = session.client("s3", region_name='us-east-2')
s3.create_bucket(Bucket='mybucket123',CreateBucketConfiguration={'LocationConstraint': 'us-east-2'})
    

And I've set wildcards for my s3 permissions with a so after cfn generate I end up with the following resource-role.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  This CloudFormation template creates a role assumed by CloudFormation
  during CRUDL operations to mutate resources on behalf of the customer.

Resources:
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      MaxSessionDuration: 8400
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: resources.cloudformation.amazonaws.com
            Action: sts:AssumeRole
      Path: "/"
      Policies:
        - PolicyName: ResourceTypePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                - "dynamodb:*"
                - "s3:*"
                Resource: "*"
Outputs:
  ExecutionRoleArn:
    Value:
      Fn::GetAtt: ExecutionRole.Arn

I have the following in my DELETE action of my resource provider:

s3 = session.client("s3", region_name='us-east-2')
s3.delete_bucket(Bucket='mybucket123')

But whenever I try to test with cfn test (with sam local start-lambda running) I get the following error as though my roles are getting ignored.

An error occurred (AccessDenied) when calling the DeleteBucket operation: Access Denied
1
  • Can you clarify what is "the cloudformation cli tool" and how do you use it? Is it aws cli? If so, how do you run it? How do you ensure that when you run the tool, it assumes the correct role?
    – Marcin
    Sep 19, 2021 at 2:59

1 Answer 1

0

I have two suggestions for you that I hope may help you.

1.Your lambda function that needs the permission to delete the bucket. So your ExecutionRole would have something like this:

Principal:
  Service:
  - resources.cloudformation.amazonaws.com
  - lambda.amazonaws.com  

2.Checking out the boto3 documentation, I found that you may put a ExpectedBucketOwner in the delete_bucket function as parameter. If the function doesn't find the account it returns a Access Denied error:

ExpectedBucketOwner (string) -- The account ID of the expected bucket owner. If the bucket is 
owned by a different account, the request will fail with an HTTP 403 (Access Denied) error.

I hope this helps in your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.