Aws-sdk-ruby: list_roles does not return role last used time

[pchaganti]

• [x] I've gone though Developer Guide for v3 and API reference
• [x] I've checked AWS Forums and StackOverflow for answers
• [x] I've searched for previous similar issues and didn't find any solution

Describe the bug
Calling list_roles should be returning the last time the role was used.

Gem name ('aws-sdk', 'aws-sdk-resources' or service gems like 'aws-sdk-s3') and its version
aws-sdk-iam

Version of Ruby, OS environment
ruby 2.6.2p47 (2019-03-13 revision 67232) [x86_64-darwin19]

To Reproduce (observed behavior)

iam = Aws::IAM::Client.new(:http_wire_trace => true)

iam.list_roles({path_prefix: "/aws-service-role/config.amazonaws.com"}).each do |response|
  response.roles.each do |d|
    puts d
  end
end

opening connection to iam.amazonaws.com:443...
opened
starting SSL for iam.amazonaws.com:443...
SSL established, protocol: TLSv1.2, cipher: ECDHE-RSA-AES128-SHA
<- "POST / HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded; charset=utf-8\r\nAccept-Encoding: \r\nUser-Agent: aws-sdk-ruby3/3.104.0 ruby/2.6.2 x86_64-darwin19 aws-sdk-iam/1.43.0\r\nHost: iam.amazonaws.com\r\nX-Amz-Date: 20200716T171717Z\r\nX-Amz-Security-Token: IQoJb3JpZ2luX2VjEBoaCXVzLWAvuAWC944jL9WEZU\r\nX-Amz-Content-Sha256: ee9cd0d78ae57cc2103d835b68b85638\r\nAuthorization: AWS4-HMAC-SHA256 Credential=RM4COVGV/20200716/us-east-1/iam/aws4_request, SignedHeaders=content-type;host;x-amz-content-sha256;x-amz-date;x-amz-security-token, Signature=448b05ed72b615d5eaf64e32530cf4a37d487\r\nContent-Length: 89\r\nAccept: */*\r\n\r\n"
-> "HTTP/1.1 200 OK\r\n"
-> "x-amzn-RequestId: 33dd247c-7b7a-4bbf-937a-45b06de65b83\r\n"
-> "Content-Type: text/xml\r\n"
-> "Content-Length: 981\r\n"
-> "Date: Thu, 16 Jul 2020 17:17:16 GMT\r\n"
-> "\r\n"
reading 981 bytes...
-> ""
-> "<ListRolesResponse xmlns=\"https://iam.amazonaws.com/doc/2010-05-08/\">\n  <ListRolesResult>\n    <IsTruncated>false</IsTruncated>\n    <Roles>\n      <member>\n        <Path>/aws-service-role/config.amazonaws.com/</Path>\n        <AssumeRolePolicyDocument>%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D</AssumeRolePolicyDocument>\n        <MaxSessionDuration>3600</MaxSessionDuration>\n        <RoleId>D62IMJHLXZ</RoleId>\n        <RoleName>AWSServiceRoleForConfig</RoleName>\n        <Arn>arn:aws:iam::345678901234:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig</Arn>\n        <CreateDate>2019-09-06T14:42:11Z</CreateDate>\n      </member>\n    </Roles>\n  </ListRolesResult>\n  <ResponseMetadata>\n    <RequestId>33dd247c-7b7a-4bbf-937a-45b06de65b83</RequestId>\n  </ResponseMetadata>\n</ListRolesResponse>\n"
read 981 bytes
Conn keep-alive

#<struct Aws::IAM::Types::Role path="/aws-service-role/config.amazonaws.com/", 
role_name="AWSServiceRoleForConfig", 
role_id="C6D62IMJHLXZ", 
arn="arn:aws:iam::345678901234:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig", create_date=2019-09-06 14:42:11 UTC, 
assume_role_policy_document="%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
description=nil, 
max_session_duration=3600, 
permissions_boundary=nil, 
tags=[], 
role_last_used=nil>

Expected behavior
This should return the last time this role was used. Checking the AWS console - it correctly displays the last time this role was used. The same information should be returned via the API per the docs for list_roles API call.

[ajredniwja]

Hey @pchaganti thank-you for reaching out to us with the issue.

Looking at the API model, RoleLastUsed should be added to the response. This might be a bug on the service side as I am having similar results for AWS CLI and JS-SDK. I have reached out to the service team and will update you here once I hear back from them.

[mullermp]

@pchaganti After doing some talking/searching internally, this appears to already have been known and acknowledged as a fault. I agree that it's a confusing user experience and a problem that IAM should fix. They've modeled their APIs to return certain members, but in many cases don't populate those members with their response. Unfortunately there are limited ways they can fix this without breaking user code, and populating these fields may have technical limitations.

I verified that you should be bale to get the role last used using the get_role API: https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/IAM/Client.html#get_role-instance_method

[mullermp]

I will push IAM with SDK management to introduce a new API version that removes these fields from the model or find ways to populate these fields with service responses.

[pchaganti]

We have cases where we retrieve a lot of roles, and will have to call the get_role API for each role just to get the last used time. Any way to populate these fields with service responses automatically would really help the user experience.

thanks for looking into this. Appreciate it!

[mullermp]

Yes, I understand your frustration with it. It's not something the Ruby SDK can do. The service is modeled to return the last used time for each role, so the SDK has a field (and method) expecting the service to respond with data to populate with. IAM service responds back with incomplete data, which is why the field is nil.

[mullermp]

From the service perspective, either they should populate that field OR the model they provide to SDKs should not include last used time (so that it's not confusing to customers).