Impossible to delete a batch compute environment

Question

Hi,
I managed to somehow create a Batch compute environment with a role like this:
arn:aws:iam::294878777873:role/aws-service-role/batch.amazonaws.com/MyCustomConversionTaskRole

I'm now completely unable to delete this compute environment:
CLIENT_ERROR - User: batch.amazonaws.com is not authorized to perform: sts:AssumeRole on resource

Attempting to delete shows a green box at the top saying the environment will be deleted but it just reverts to Invalid status. Following some online resources I tried to recreate this role but since it has an Arn of a batch-create role, I'm simply unable to recreate the role and give it the required permissions to be able to delete the compute environment.

I need help, I want to delete this environment and not keep this lingering in my account forever. 
Any help appreciated, I'm really stuck,

Riku_Kobayashi · Answer

Hello.

Can I create a normal service role with the following AWS CLI command?  
If the AWS Batch service role has already been created, the command will fail to execute.  
```
aws iam create-service-linked-role --aws-service-name batch.amazonaws.com
```
Once the role "AWSServiceRoleForBatch" has been created, try changing the service role from the AWS Batch compute screen.  
![a](/media/postImages/original/IMsUDFspRqTrayYdr8u5l_JQ)

![a](/media/postImages/original/IMsqrmO6xsTXC7vn_P1a9uWA)

Or, you can deploy the following CloudFormation template to recreate "MyCustomConversionTaskRole".

```
AWSTemplateFormatVersion: 2010-09-09
Resources:
  AWSBatchServiceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: MyCustomConversionTaskRole
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - 'batch.amazonaws.com'
            Action:
              - 'sts:AssumeRole'
      Path: /service-role/batch.amazonaws.com/
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSBatchServiceRole
```
Deploying the above CloudFormation template will create "arn:aws:iam::294878777873:role/aws-service-role/batch.amazonaws.com/MyCustomConversionTaskRole".

I would recommend opening a case with AWS Support under "Account and billing" and asking about this.  
"Account and billing" inquiries are free of charge.  
You can contact us at the following URL:  
https://console.aws.amazon.com/support

blais · Answer

FWIW, the environment is edgebips-fargate-compute-env

blais · Answer

- I already tried updating the service role from the console; it just won't let me. It lets me select the arn:aws:iam::294878777873:role/aws-service-role/batch.amazonaws.com/AWSServiceRoleForBatch role but when I save it does not get updated.

- Attempting to do this through the console also doesn't work:
I get this error:
An error occurred (ClientException) when calling the UpdateComputeEnvironment operation: A CE using a user-provided role cannot be updated to use Batch Service Linked Role.

Please help. I'm unable to resolve this on my own. I actually think this is a bug in the system, nothing I've been able to do to resolve it, including the steps above.

re:Post Agent · Answer

I understand your frustration with being unable to delete the AWS Batch compute environment. This is a known issue that can occur when there are problems with the associated IAM roles. Here are some steps you can try to resolve this:

1. First, it's important to note that the role you mentioned (MyCustomConversionTaskRole) is a service-linked role, which is managed by AWS and cannot be manually created or modified. This explains why you're unable to recreate it.

2. The error message you're seeing suggests that the Batch service doesn't have the necessary permissions to assume the role. This could be because the role has been deleted or its trust relationship has been modified.

3. To resolve this, you should try updating the compute environment with a correct service role. You can do this through the AWS Batch console:
   - Go to the AWS Batch console
   - Select the invalid compute environment
   - Choose "Update" from the Actions menu
   - In the update form, specify a valid AWS Batch service role

4. If you don't have a valid AWS Batch service role, you can create one with the necessary permissions. The role should trust the batch.amazonaws.com service and have the AWSBatchServiceRole managed policy attached.

5. If updating the compute environment doesn't work, you may need to use the AWS Batch UpdateComputeEnvironment API to update the service role. When doing this, make sure to use the AWSServiceRoleForBatch service-linked role, as this is required for updating parameters that need an infrastructure update.

6. If none of these steps work, you may need to contact AWS Support for further assistance. They have additional tools and permissions to help resolve issues with stuck resources.

Remember, it's crucial to use the supported AWS Batch APIs or console to manage compute environments and avoid manually modifying Batch-managed resources to prevent such issues in the future.  
**Sources**  
[INVALID compute environment - AWS Batch](https://docs.aws.amazon.com/batch/latest/userguide/invalid_compute_environment.html)  
[UpdateComputeEnvironment - AWS Batch](https://docs.aws.amazon.com/batch/latest/APIReference/API_UpdateComputeEnvironment.html)  
[Cannot delete Computer Enviroments on Batch | AWS re:Post](https://repost.aws/questions/QUvr1nn_cEQaOrbW1xEzFC0Q/cannot-delete-computer-enviroments-on-batch)

Impossible to delete a batch compute environment

Relevant content