4 ms·
Yes, in the service that provides the AWS resource. Because it didn’t handle the fact that the role it’s using might be deleted or otherwise rendered un-assuma
by orf 4y ago
Yes, in the service that provides the AWS resource.
Because it didn’t handle the fact that the role it’s using might be deleted or otherwise rendered un-assumable for a variety of different reasons at any point in time.
Which is a feature. Not a bug.
- TedDoesntTalk 4y agoI’m curious how you see this as a feature when it can get you into a very expensive and unresolvable situation; a AWS resource can’t be deleted and is running up costs. You’re at the mercy of AWS support.
- bergenty 4y agoIt’s not a feature but how do you solve this? You can’t block role deletion because it has a resource associated with it, that would be a functional nightmare.
- speedgoose 4y agoA very classic way of doing would be to prevent deleting a role that are resource tightly associated to it by default. If someone really wants to delete the role anyway, you can provide a feature to do that and delete associated ressources in cascade.
- TedDoesntTalk 4y ago"Cascading deletes"
- bergenty 4y agoIt’s like you didn’t even read what I wrote. That way sucks, especially if you have hundreds of allocated resources. Cascade delete is not a realistic option here either. Imagine someone leaves the company without notice. All their resources need to be deleted?
- speedgoose 4y agoWhen someone leaves a company you look at their resources and assigned new people to them or delete them. But you should prefer teams and projects over individuals anyway.
- speedgoose 4y agoIt can also be a security vulnerability if the resource that cannot be deleted is compromised and can access or contain critical data for example.
- orf 4y agoCan it? The only case I know of involving roles specially is Batch, and the resources it’s trying (and failing) to clean up are ones with absolutely no cost. It’s a feature because there are plenty of cases, such as a role being compromised, where you don’t want to cascade-delete every single associated resource without any need. If you want this then you can opt into it by using cloudformation.