After fail to create IAM role, cannot deploy anymore.

[chroju]

Hello.

When I execute chalice deploy, faced error of IAM role.

$ chalice deploy --no-autogen-policy
Creating role: sample-chalice
ERROR - While deploying your chalice application, received the following error:

 An error occurred (MalformedPolicyDocument) when calling the PutRolePolicy
 operation: Syntax errors in policy.

and I have fixed syntax error, deploy again.
However, the IAM role had been made incompletely by the last deploy, so the deploy failed with another error.

$ chalice deploy --no-autogen-policy
Updating IAM policy for role: sample-chalice
ERROR - While deploying your chalice application, received the following error:

 An error occurred (NoSuchEntity) when calling the DeleteRolePolicy operation:
 The role policy with name sample-chalice cannot be found.

If I wanted deploy to succeed, I had to delete incomplete IAM role once with AWS console or AWS CLI. chalice delete command was useless in this case.

Is this as you expected ?

environment

• chalice 1.0.3
• Python 3.6.1

[jamesls]

Thanks for reporting, this is a bug. We'll get this fixed.

[jamesls]

Fixed via #636

[abdullah353]

I have started the app using chalice and stucked, the steps that i did on EC2 ubuntu instance were following:

ubuntu@ip-172-31-44-209:~$ chalice new-project traindexServiceAPI
ubuntu@ip-172-31-44-209:~$ cd traindexServiceAPI/
ubuntu@ip-172-31-44-209:~/traindexServiceAPI$ chalice deploy
Creating role: traindexServiceAPI-dev
ERROR - While deploying your chalice application, received the following error:

 An error occurred (AccessDenied) when calling the CreateRole operation: User: 
 arn:aws:iam::xxxxx:user/devop is not authorized to perform: 
 iam:CreateRole on resource: arn:aws:iam::xxxxx:role/traindexServiceAPI-
 dev

# After allowing iam:CreateRole from AWS Console. 
ubuntu@ip-172-31-44-209:~/traindexServiceAPI$ chalice deploy
Creating role: traindexServiceAPI-dev
ERROR - While deploying your chalice application, received the following error:

 An error occurred (AccessDenied) when calling the PutRolePolicy operation: 
 User: arn:aws:iam::xxxxx:user/devop is not authorized to perform: 
 iam:PutRolePolicy on resource: role traindexServiceAPI-dev

# After allowing iam:PutRolePolicy from AWS Console. 
ubuntu@ip-172-31-44-209:~/traindexServiceAPI$ chalice deploy

The following actions will be added to the execution policy:

logs:PutLogEvents
logs:CreateLogGroup
logs:CreateLogStream

Would you like to continue?  [Y/n]: Y
Updating IAM policy for role: traindexServiceAPI-dev
ERROR - While deploying your chalice application, received the following error:

 An error occurred (AccessDenied) when calling the DeleteRolePolicy operation: 
 User: arn:aws:iam::xxxxx:user/devop is not authorized to perform: 
 iam:DeleteRolePolicy on resource: role traindexServiceAPI-dev

[aalvrz]

I am still experiencing the same issue when deploying:

Updating IAM policy for role: <role>
ERROR - While deploying your chalice application, received the following error:

 An error occurred (NoSuchEntity) when calling the DeleteRolePolicy operation: 
 The role policy with name <role> cannot be found.

I don't understand why Chalice is still trying to delete the role on deployment...?

I cannot seem to be able to fix this, since the role doesn't exist in AWS. Therefore I cannot even remove it with the console...

[ericzbeard]

I'm getting the same error using the latest version.

[ericzbeard]

A quick workaround is to manually create the inline policy using the name from the error message.

[hatdropper1977]

FWIW I receive the same error as well.

[owenbrown]

Fixing this error is important to me.

[kotowick]

Is there still no fix?

[chroju]

This issue is what I was open, and I have confirmed that the phenomenon I reported was fixed via #636. Under what situation do you still encounter the same error ?

[ericzbeard]

I still see this in chalice 1.1.0, and I can't upgrade to 1.3.0 since it requires an older version of pip.

pkg_resources.DistributionNotFound: The 'pip==9.0.1' distribution was not found and is required by the application

A reminder on the workaround in case anyone else stumbles across this: there should be a role called {your-app-name} with a policy under it called {your-app-name}. If they don't exist, create them. It doesn't matter what the policy does, since chalice will delete it.

[milescrawford]

This is not fixed. Another way this happens is if chalice SUCCESSFULLY deletes the role, but does so when deploying in an environment that does not update the stored (in github, outside a docker container, etc) .chalice/deployed<STAGE>.json file.

Then, the metadata in the file doesn't match reality and it attempts to delete every time you deploy.