Missing (resource) permission in AWSAppRunnerFullAccess causes failure when calling the CreateVpcConnector operation

Question

Not really a question, more of a 'bug report'. Solution is provided in this post.
`arn:aws:iam::aws:policy/AWSAppRunnerFullAccess` is missing permission to create `AWSServiceRoleForAppRunnerNetworking` service role.
That makes it impossible to create vpc connector despite using `FullAccess` policy. Error message doesn't really help, as pointed by it policy is in fact attached.

Steps to reproduce:
1. Use user or assume role with `AWSAppRunnerFullAccess` permissions.
2. Run
```shell
aws apprunner create-vpc-connector --vpc-connector-name test-vpc-connector --subnets  --security-groups 
```
Command produces following error:
"An error occurred (InvalidRequestException) when calling the CreateVpcConnector operation: AccessDenied. Couldn't create a service-linked role for App Runner. When creating the first vpc connector in the account, caller must have the 'iam:CreateServiceLinkedRole' permission. Use the 'AWSAppRunnerFullAccess' managed user policy to ensure users have all required permissions."

Temporary solution: add additional policy with `Allow` `iam:CreateServiceLinkedRole` on resource `arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner`.

Long term, I believe it should be added to AWSAppRunnerFullAccess.

Accepted Answer

Temporary solution: add additional policy with `Allow` `iam:CreateServiceLinkedRole` on resource `arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner`.

Long term - to be fixed by AWS :)

Answer

I'm using CDK and I added the allow the statement to both` cdk-qualifier-cfn-exec-role-*****-region` and  `cdk-qualifier-deploy-role-*****-region` yet it still fail. When deploying with CDK which role should contain this policy statement?

`Resource handler returned message: "AccessDenied. Couldn't create a service-linked role for App Runner. When creating the first vpc connector in the account, caller must have the 'iam:CreateServiceLinkedRole' permission. Use the 'AWSAppRunnerFullAccess' managed user policy to ensure users have all required permissions.`

> Temporary solution: add additional policy with Allow iam:CreateServiceLinkedRole on resource arn:aws:iam::*:role/aws-service-role/apprunner.amazonaws.com/AWSServiceRoleForAppRunner.
> Long term - to be fixed by AWS :)

Missing (resource) permission in AWSAppRunnerFullAccess causes failure when calling the CreateVpcConnector operation

관련 콘텐츠