Create instanceprofile with CDK and Python

user_8151574 0
Viewed 1209

I am new to cdk and trying to create an instance profile with CDK+Python with the following code. I have already created the Role (gitLabRunner-glue) successfully thru CDK and wanting to use it with the intance profile. However, when i run the following code, i get an error gitLabRunner-glue already exists

Can somebody please explain what am i missing ?

from aws_cdk import core as cdk
from aws_cdk import aws_glue as glue
from aws_cdk import aws_ec2 as _ec2
from aws_cdk import aws_iam as _iam

class Ec2InstanceProfile(cdk.Stack):
    def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # role = _iam.Role(self, "instanceprofilerole", role_name="gitLabRunner-glue",
        #              assumed_by=_iam.ServicePrincipal(service='ec2.amazonaws.com'))


        ec2gitLabRunnerinstanceprofile = _iam.CfnInstanceProfile(
            self,
            "ec2gitLabRunnerinstanceprofile",
            instance_profile_name="ec2-gitLabRunner-glue",
            roles=["gitLabRunner-glue"] # also tried with this[role.role_name]
    )
amazon-cloudformation amazon-iam aws-cdk amazon-ec2 python
2 Answers

Does your AWS account already have a role with that name in it?

the Cfn Functions in cdk represent constructs and services that have not been fully hooked into all that is CDK. As such, they often don't do things that others would - where as a CloudFormation Template for the instance profile may just hook into the existing role, the coding in the back of this cfn function may go ahead and create a role item in the template output.

if you do a cdk synth, look in your cdk.out directory, find your cloudformation template, then do a search for gitLabRunner-glue - you may find there is a AWS::IAM::ROLE being created, indicating when CloudFormation attempts to run based of the template created by cdk it tries to create a new resource and it cant.

You have a couple options to try:

  1. As you tried, uncomment the role again and use role.role_name but name the role something else or, as CDK recommends, don't include a name and let it name it for you

  2. search your aws account for the role and delete it

  3. If you absolutely cannot delete the existing role or cannot create a new one with a new name, then import the role, using (based off your imports)

    role = _iam.Role.from_role_arn(self, "ImportedGlueRole", role_arn="arn:aws:of:the:role", add_grants_to_resources=True)

be wary a bit of the add_grants_to_resources - if its not your role to mess with cdk can make changes if you make that true and that could cause issues elsewhere - but if its not true, then you have to update the Role itself in the aws console (or cli) to accept your resources as able to assume it.

user_115917580

I made it work like this, not the desired model though, but given the limitations of cdk, i couldn't find any other way.

from aws_cdk import core as cdk
from aws_cdk import aws_glue as glue
from aws_cdk import aws_ec2 as _ec2
from aws_cdk import aws_iam as _iam

class Ec2InstanceProfile(cdk.Stack):
    def __init__(self, scope: cdk.Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        boundary = _iam.ManagedPolicy.from_managed_policy_arn(self, "Boundary",
                                                           "arn:aws:iam::${ACCOUNT_ID}:policy/app-perm-boundary")

        # role = _iam.Role(self, "instanceprofilerole", role_name="gitLabRunner-glue",
        #              assumed_by=_iam.ServicePrincipal(service='ec2.amazonaws.com'))

        ec2_gitlabrunner_glue = _iam.Role(
            self, 'ec2-gitlabrunner-glue',
            role_name='gitLabRunner-glue',
            description='glue service role to be attached to the runner',
            # inline_policies=[write_to_s3_policy],
            assumed_by=_iam.ServicePrincipal('ec2.amazonaws.com'),
            permissions_boundary=boundary
        )

        ec2gitLabRunnerinstanceprofile = _iam.CfnInstanceProfile(
            self,
            "gitLabRunnerinstanceprofile",
            instance_profile_name="gitLabRunner-glue",
            roles=["gitLabRunner-glue"]
    )
user_81515740
Related