SecretsManagerRDSMySQLRotationSingleUser application doesn't output role resource in aws serverlessrepo get-application output

[mahesh-ogale]

I tried using SecretsManagerRDSMySQLRotationSingleUser application to create a lambda function in the AWS console but it looks like this application tries to create a role SecretsManagerRDSMySQLRotationSingleUserRole internally. My company doesn't allow role creation like this. I would like to use this application (to make use of standard rotation code and bundled pymysql etc) but would like to provide my custom role manually.

I did the following command and it only outputs SecretsManagerRDSMySQLRotationSingleUser resource and not the SecretsManagerRDSMySQLRotationSingleUserRole. Also, I don't see any role param for SecretsManagerRDSMySQLRotationSingleUser resource where I can plug-in my custom role.

aws serverlessrepo get-application --application-id arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser

I will really appreciate any input on this.

[mahesh-ogale]

Looks like there is already an open question about this https://github.com/awslabs/serverless-application-model/issues/1009

[rstevens011]

Thank you for creating this issue. I was able to replicate this using this template:

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: SAR nested app stack test
Resources:
  NestedApp:
    Type: AWS::Serverless::Application
    Properties:
      Location:
        ApplicationId: arn:aws:serverlessrepo:us-east-1:297356227824:applications/SecretsManagerRDSMySQLRotationSingleUser
        SemanticVersion: 1.0.116
      Parameters:
        endpoint:
          Fn::Sub: https://secretsmanager.${AWS::Region}.amazonaws.com
        functionName: RDSMySQLSingleUserRotationLambda
        Role:
          Fn::GetAtt:
            - IAMRole
            - Arn
  IAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - Fn::Sub: arn:aws:iam::aws:policy/AdministratorAccess

The SAM template that is published as of today does not have a way to pass in a customer-definable role ARN as you described. I've marked this as an feature enhancement.

[santhosh-vikraman]

Any update on this like we can pass the Role to the template?

[jbct]

Hi mahesh - we have added this as a feature request that we're tracking internally. Since this isn't tied to the GitHub sample, I'm closing the issue here.