https://pulumi.com logo
Join Slack
Powered by
I am trying to run `stack.preview` with a tiny pro...
# automation-api
w
I am trying to run 
stack.preview
with a tiny program that just contains an 
aws.iam.Role
. I keep getting this error:
Copy code
pulumi:providers:aws (default_6_29_0):
        error: rpc error: code = Unknown desc = 2 errors occurred:
        	* CheckConfig failed because of malformed resource inputs: error unmarshalling property "assumeRole": invalid character 'a' looking for beginning of value
        	* CheckConfig failed to unmarshal news: error unmarshalling property "assumeRole": invalid character 'a' looking for beginning of value
That resource doesn’t have an 
assumeRole
property AFAICT (it has 
assumeRolePolicy
). Any idea what could be going on? It looks like this is error is coming from the 
pulumi-terraform-bridge
. How can I find out what is causing this?
l
Can you post the Role constructor snippet?
w
Copy code
const program: PulumiFn = async () => {
  new aws.iam.Role(
    "Bootstrap",
    {
      description: `Allows users to deploy the TODO project.`,
      path: "/user/",
      name: "Bootstrap",
      assumeRolePolicy: JSON.stringify({})
    },
    opts
  );
};
I know that isn’t a valid policy but I am trying to minimise the problem
l
That'll be the problem. Use a valid assumeRolePolicy.
w
I’m pretty sure the previous one was valid. I’ll inline it and update this thread.
Yeah, simply copy/pasting the example from the docs has the same problem:
Copy code
const program: PulumiFn = async () => {
  new aws.iam.Role(
    "Bootstrap",
    {
      description: `Allows users to deploy the TODO project.`,
      path: "/user/",
      name: "Bootstrap",
      assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Sid: "",
            Principal: {
                Service: "<http://ec2.amazonaws.com|ec2.amazonaws.com>",
            },
        }],
    })
    },
    opts
  );
};
l
That all looks good to me. I don't know what the problem is. I'd think about removing the various Pulumi plugins etc., and reinstalling; maybe there's a bad version of something somewhere?
w
Well thanks for looking. I’ll try that. I tried updating to the latest but that didn’t help. I’m also building the provider so I’ll have a go at debugging it and see if that gives any clues.
l
Oh wait, I've had a thought: are you creating the aws.Provider instance in code?
Can you post that code?
w
Copy code
const { version } = require("@pulumi/aws/package.json");
  await stack.workspace.installPlugin("aws", version);
l
Not the plugin, the instance of 
aws.Provider
that you're using. Are you using the default provider? If you are, what 
aws:...
properties are you putting in your stack YAML file?
w
Oh crap yeah that seems to be it. I’ve got:
Copy code
config:
  aws:assumeRole: arn:aws:iam::675932482749:role/user/Bootstrap
It’s a bit of an unusual setup. I basically run the program twice. Once with a manually created user and then once it is bootstrapped I run it again with the bootstrap role. I was setting it in code so this shouldn’t be here in the YAML file (not sure why my search didn’t find it).
Did the format for that change or something?
l
Lot of colons in there, I'd probably wrap that in quotes. Also I know that some role properties are strictly the role name, not ARN. Let me look that one up.
Hmm. I'd have to dig into the code of the provider to see what is done when only the default property is provided. According to the provider docs, the assumeRole property should contain a ProviderAssumeRole object, not a string. That object has a roleArn property which would match what you've got. It may be that the provider knows to convert a string to an object with a roleArn, but maybe not. You could try setting this:
Copy code
config:
  aws:assumeRole:
    roleArn: "arn:aws:iam::675932482749:role/user/Bootstrap"
w
Yeah I wondered about that. The docs say that the “attributes” are optional but perhaps not or if it is then maybe it expects the role name and not an ARN. Well that’s plenty to go off of for now. Thanks a lot!
Open in Slack
PreviousNext
Powered by