@aws-cdk/aws-batch-alpha: Compute Environment with service role `role/AWSServiceRoleForBatch` is created and cannot be deleted

[ikeyan]

Describe the bug

I created a AWS Batch Compute Environment with service role Role.fromRoleName(this, 'BatchServiceRole', 'AWSServiceRoleForBatch'), and deployed it. The deploy and its rollback failed, and The compute environment cannot be deleted.

Expected Behavior

CloudFormation should:

• deploy the Compute Environment with the right service-linked role arn:aws:iam::*:role/aws-service-role/batch.amazonaws.com/AWSServiceRoleForBatch (even if it does not exist it may create one automatically), or
• not deploy the Compute Environment because the role cannot be found

Current Behavior

• CloudFormation creates Compute Environment but fails to stabilize it

  CREATE_FAILED
  Resource handler returned message: "Resource of type 'AWS::Batch::ComputeEnvironment' with identifier 'arn:aws:batch:ap-northeast-1:************:compute-environment/dev-data-test-batch' did not stabilize." (RequestToken: ********-****-****-****-************, HandlerErrorCode: NotStabilized)

• it fails to delete the Compute Environment

  DELETE_FAILED
  Resource handler returned message: "Resource of type 'AWS::Batch::ComputeEnvironment' with identifier 'arn:aws:batch:ap-northeast-1:************:compute-environment/dev-data-test-batch' did not stabilize." (RequestToken: ********-****-****-****-************, HandlerErrorCode: NotStabilized)

• on the compute-environments/detail page, its status is like this:

  INVALID - CLIENT_ERROR - User: batch.amazonaws.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::830311496929:role/AWSServiceRoleForBatch (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: bf87c5cf-1bf1-47fd-ac27-f4f7fa4e8d25; Proxy: null)

  and the service role is arn:aws:iam::************:role/AWSServiceRoleForBatch

• I tried to delete the Compute Environment but failed

• I tried to create the role arn:aws:iam::************:role/AWSServiceRoleForBatch, but cannot create a role whose name starts with AWSServiceRoleFor

• Now I have a Compute Environment that cannot be deleted

Reproduction Steps

        const vpc = new Vpc(this, 'Vpc', {
            cidr: '10.0.0.0/16',
            subnetConfiguration: [
                {
                    cidrMask: 24,
                    name: 'public',
                    subnetType: SubnetType.PUBLIC,
                },
                {
                    cidrMask: 24,
                    name: 'private',
                    subnetType: SubnetType.PRIVATE_ISOLATED,
                },
            ],
        });
        const serviceRole = Role.fromRoleName(this, 'BatchServiceRole', 'AWSServiceRoleForBatch');
        new ComputeEnvironment(this, 'ComputeEnvironment', {
            computeEnvironmentName: 'test-batch',
            computeResources: {
                type: ComputeResourceType.ON_DEMAND,
                allocationStrategy: AllocationStrategy.BEST_FIT_PROGRESSIVE,
                vpc,
                vpcSubnets: vpc.selectSubnets({ subnetType: SubnetType.PUBLIC }),
                securityGroups: [],
                instanceTypes: [new InstanceType(InstanceClass.M6I)],
            },
            serviceRole,
        });

deploy the above as a stack.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.27.0 (build 8e89048)

Framework Version

2.27.0-alpha.0

Node.js Version

v16.13.1

OS

Windows 10 21H2

Language

Typescript

Language Version

TypeScript (4.7.3)

Other information

No response

[mrgrain]

Alpha module -> p2

Can confirm that the above code does reproduce the issue. However rollback also worked and deleted all Resources.

[mrgrain]

@ikeyan to remove the un-removable ComputeEnvironment please open a ticket with the support team.

[rjuengling-hf]

Where may I track progress on this issue?

[comcalvi]

I've reproduced this, but the CE fails to delete for me. This is a CFN issue