Bug:
CloudFormation resource AWS::ServiceCatalog::PortfolioPrincipalAssociation
allows for creating resources with type IAM_PATTERN, even though the documentation does not allow the. Those resources always fail to be deleted.
Excepted behavior:
- Resource fails validation during creation, or
- Resource can be deleted
To replicate:
Deploy this template. Delete it.
{
"Resources": {
"Portfolio": {
"Type": "AWS::ServiceCatalog::Portfolio",
"Properties": {
"DisplayName": "test",
"ProviderName": "test",
"Description": "test"
},
"PrincipalAssoc": {
"Type": "AWS::ServiceCatalog::PortfolioPrincipalAssociation",
"Properties": {
"PortfolioId": {
"Ref": "Portfolio"
},
"PrincipalARN": "arn:aws:iam:::role/SomeRolePattern*",
"PrincipalType": "IAM_PATTERN"
}
}
}
}
}