amplify-backend icon indicating copy to clipboard operation
amplify-backend copied to clipboard

Amplify UI gen2 will not offer to create service role with monorepo option

Open OperationalFallacy opened this issue 8 months ago • 7 comments

Before opening, please confirm:

Amplify Hosting feature

Monorepo

Is your feature request related to a problem? Please describe:

The UI has a bug. This is NOT a feature request.

If user selects monorepo while connecting repository, the UI skips creating service role. Which leads to deployment failures.

Second related problem, there is no option to set role in the UI (the respective edit button simply doesn't show anything role related in the UI).

Workaround is to create and set role manually

aws amplify update-app --app-id xxx --iam-service-role-arn arn:aws:iam::xxx:role/AmplifyDeployments --profile app-prod

Resources:
  AmplifyDeploymentRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: AmplifyDeployments
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: amplify.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AmplifyBackendDeployFullAccess
        - arn:aws:iam::aws:policy/AmazonSSMFullAccess <-- this may be optional depends how your pipeline deployed stuff

Overall, not a good experience since it was hard to figure out why deployments were failing. They were using some default role from amplify-owned account.

Describe how you'd like this feature to work

Document when and why this role should be created, what permissions it needs, what options users have to create it etc.

OperationalFallacy avatar Jun 22 '24 21:06 OperationalFallacy