// Attach required role for ECS to pull images
const roleAttachment = new aws.iam.PolicyAttachment(
  `${solution_name}-policy-attachment`,
  {
    roles: [solutionRole.name],
    policyArn:
       aws.iam.ManagedPolicy.AmazonECSTaskExecutionRolePolicy,
  }
);

The

AmazonECSTaskExecutionRolePolicy

is attached to another Role (role-b) in an AWS account. When you run

pulumi destroy

on the pipeline with the attachment in it, the attachment is also removed from

role-b

. System down. This seems related: https://github.com/pulumi/pulumi/issues/918 What am suppose to do besides create a bunch of user-defined policies and not use managed policies? Not what we want to do.

Hi Chad, the use of

aws.iam.PolicyAttachment

creates exclusive attachments of IAM policies across AWS accounts. Pulumi docs: https://www.pulumi.com/docs/reference/pkg/aws/iam/policyattachment/ You can use

aws.iam.RolePolicyAttachment

for your use case which does not create exclusive relationships.

Oh @green-stone-37839 You mean this BIG warning in the documentation I presume

WARNING: The aws.iam.PolicyAttachment resource creates exclusive attachments of IAM policies.......

Thank you!!!!

Anytime!

Probably a cut-n-paste from some solution and didn't even read that page. Appreciate this. 🙂

no problem!

My teammates suggested

ExclusivePolicyAttachment

would be a nice resource name. Just sharing.