How to avoid IAM dependencies preventing CFT delete when a role is referenced by an IAM Profile and EC2 Policy

Viewed 8465

I have a CFT that has these 5 resources:

MasterAsg:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    ...
    LaunchConfigurationName:
      Ref: MasterLaunchConfig
MasterLaunchConfig:
  Type: AWS::AutoScaling::LaunchConfiguration
  Properties:
    ...
    IamInstanceProfile:
      Ref: MasterIntanceProfile
MasterIntanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Roles:
      - Ref: MasterIamRole
MasterIamRole:
  Type: AWS::IAM::Role
  Properties:
    ...
MasterIamPolicy:
  Type: AWS::IAM::Policy
  Properties:
    Roles:
      - Ref: MasterIamRole
    ...

Below is a drawing of how these are dependent on each other.

Dependency graph of CFT resources

I've had some cases where a different part of this CFT fails and causes the stack to roll back. Below is the error I get:

[MasterIamRole] Cannot delete entity, must detach all policies first. (Service: AmazonIdentityManagement; Status Code: 409; Error Code: DeleteConflict

How can I either change how these resources are created or add the right DependsOn attribute to this stack to prevent running into this in the future?

1 Answers
Related