Cfn-python-lint: AWS::Batch::ComputeEnvironment: Property "InstanceRole" can Ref to resources of types [AWS::IAM::Role]

[demartinofra]

cfn-lint version: 0.11.0

Description of issue.
InstanceRole in AWS::Batch::ComputeEnvironment should reference a AWS::IAM::InstanceProfile resource and not a AWS::IAM::Role.

Please provide as much information as possible:

• Template linting issues:
  
  
  
  • Please provide a CloudFormation sample that generated the issue.
    
    https://github.com/aws/aws-parallelcluster/blob/develop/cloudformation/batch-substack.cfn.json#L411
  
  
  • when using the Arn with Fn:GetAtt the error is: "InstanceRole" has no valid Fn::GetAtt options...
    
    while InstanceProfile has a GetAtt option https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html#w2ab1c21c10d144c23c13
  
  
  • when using the Ref the error is: Property "InstanceRole" can Ref to resources of types [AWS::IAM::Role]
    
    while the correct Property to reference is AWS::IAM::InstanceProfile
  
  
  • If present, please add links to the (official) documentation for clarification.
    
    https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-computeenvironment-computeresources.html#cfn-batch-computeenvironment-computeresources-instancerole
  
  

[kddejong]

Looking into it.

[kddejong]

I have a fix coming very shortly. I'll try to get this patched for you today.

I tested your entire template. There is 3 additional errors that are showing up related to ServiceRoles and SpotIamFleetRole. The reason we have started to flag those as errors is that if you have Path set on the IAM role it will fail. Idally it would be a GetAtt to the Arn. I may have to figure out a different way to do this check since it seems to relate to the Path in the Refed resource.

[demartinofra]

Thank you for the very prompt response :)

Yep I published a PR earlier to fix the other warnings in that template: https://github.com/aws/aws-parallelcluster/pull/818. Thanks!

[kddejong]

In my opinion that is the right way to go @demartinofra (switching from Ref to GetAtt for the ARN on the role) but I have a feeling that you aren't the only one doing this type of REFing. So we are going to add Ref when looking for an IAM Role Arn. We will try to figure out what we need to do handle the Path issue going forward. Sorry for the issues and hopefully will have you working shortly.

[demartinofra]

Thanks for the quick fix!!!

[enrico-usai]

Hi, your recent release re-opened this issue:

cfn-lint run-test: commands[1] | cfn-lint batch-substack.cfn.json
E3008 Property "InstanceRole" has no valid Fn::GetAtt options at Resources/ComputeEnvironment/Properties/ComputeResources/InstanceRole/Fn::GetAtt
batch-substack.cfn.json:415:13

You can see the travis failure here: https://travis-ci.org/enrico-usai/aws-parallelcluster/jobs/516121086

Could you help us?

[kddejong]

I'm on it. The fix is in and the patched release will be out there shortly. Sorry we are bopping between this and another issue. I think I have this cleared up for good now. There seems to be a lot of issues with how certain resources handle these properties. Some take the Arn, some take the name, some take both. The documentation isn't always clear which makes it harder. Either way we split apart the IamInstanceProfile to have an Arn type, Name type, and a both. At this point I have set the Batch Compute Instances to use both as it looks like (from the documentation) the Ref will also work (I haven't tested this just basing it on the docs).

[enrico-usai]

Hi, your recent release re-opened this issue:

E3008 Property "SpotIamFleetRole" has no valid Fn::GetAtt options at Resources/ComputeEnvironment/Properties/ComputeResources/SpotIamFleetRole/Fn::If/1/Fn::GetAtt
batch-substack.cfn.json:409:17

See travis failure: https://travis-ci.org/aws/aws-parallelcluster/jobs/577754327