AWS Application tag-sync error
Hello,
For an AWS Application, I tried to create a tag-sync. The Console Screen (added below) requires to Select a role that has permission to tag all of the resources that you include in the application. I've manually created the role with below Trust Relationship and permissions, and selected it in the screen. But sometimes I got an error about Trust Relationships of the IAM Role, and sometime the screen freezes, and never makes the tag-sync.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": [
"arn:aws:iam::<id>:root",
"arn:aws:iam::<id>:user/<user>"
],
"Service": "servicecatalog-appregistry.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Permissions:
- ResourceGroupsandTagEditorFullAccess
- ResourceGroupsandTagEditorReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
Could you please specify how should the Role look like so that the tag-sync to work ?
Thank you,
Mihai ADAM
- Newest
- Most votes
- Most comments
Hi,
As per documentation at https://docs.aws.amazon.com/servicecatalog/latest/arguide/app-tag-sync.html, you current trust policy has to be updated to
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Statement1",
"Effect": "Allow",
"Principal": {
"Service": "resource-groups.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
And then you should follow the subsequent guidance:
After specifying the trust policy for the role, you must give the role permissions
to tag and untag application resources. To easily and effectively apply the necessary
permissions to the role, we recommend using both the AWS Resource Groups
ResourceGroupsTaggingAPITagUntagSupportedResources and ResourceGroupsandTagEditorFullAccess
AWS managed policies. These policies grant the permissions required to tag and untag all
of the resource types supported by Resource Groups Tagging API, with some exceptions. This policy
also grants the permissions required to retrieve all tagged, or previously tagged, resources through the
Resource Groups Tagging API.
Best,
Didier
Hello,
After some investigations, the above behaviour looks like a bug, because in my environment, in IE and Chrome on Windows 11, the above interface is not clickable: none of the above links work, including the button link.
When I tried to create the tag-sync from CLI it worked, and creates a new group AWS_TagSyncTask-<id> with comment This group tracks resources part of an application and is managed by Resource Groups for use with the tag-sync task
Not all the tagged Resources were included. For example, it was not included HTTP API Gateway.
Thank you,
Mihai ADAM
answered 2 years ago
Same behavior observed here: it's impossible to validate the form to create the tag sync. Button is clickable, but doesnt do anything (and no error in browser console).
Thank you for providing details about your AWS Application tag-sync issue. It appears that there are a few adjustments needed in your IAM role configuration to resolve the problem.
First, the trust relationship for the role should be modified. Instead of using "servicecatalog-appregistry.amazonaws.com" as the service principal, you should use "resource-groups.amazonaws.com". This is because AWS Resource Groups is the service responsible for managing tag-sync tasks.
Here's how the trust policy should look:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "resource-groups.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }
Regarding the permissions, you're on the right track with the policies you've attached. The recommended approach is to use both the "ResourceGroupsTaggingAPITagUntagSupportedResources" and "ResourceGroupsandTagEditorFullAccess" managed policies. These policies grant the necessary permissions to tag and untag all resource types supported by Resource Groups Tagging API, with some exceptions.
You can remove the "ResourceGroupsandTagEditorReadOnlyAccess" policy as it's not necessary when you have the FullAccess policy.
If you continue to experience issues after making these changes, you may want to check for any potential conflicts with other IAM policies or permissions in your AWS account. Also, ensure that you're not exceeding the maximum limit of 100 tag-sync tasks per account across all applications.
If the problem persists, you might want to retry the failed tag-sync task after making these changes, or contact AWS support for further assistance.
Sources
Resource tag-sync and required permissions - AWS Service Catalog AppRegistry
Resolving tag-sync errors in myApplications - AWS Management Console
Thank you for your answer, After making all the specified changes in the IAM Role, and filling all options in the above pop-up (Create tag-synch), on Confirm click, the screen remains frozen and nothing happened (no error, but also no update). So, it is not enough to work.
Thank you for your answer, As a solution, I've added the Resources to Application manually, in Manage resources window