codebuild: Fix service_role Required

[koooge]

Changes proposed in this pull request:

• Change 1
  codebuild) service_role seems to be required.

$ terraform apply -auto-approve
aws_codebuild_project.test: Creating...
  artifacts.#:                                   "" => "1"
  artifacts.1178773975.location:                 "" => ""
  artifacts.1178773975.name:                     "" => ""
  artifacts.1178773975.namespace_type:           "" => ""
  artifacts.1178773975.packaging:                "" => ""
  artifacts.1178773975.path:                     "" => ""
  artifacts.1178773975.type:                     "" => "NO_ARTIFACTS"
  badge_enabled:                                 "" => "false"
  badge_url:                                     "" => "<computed>"
  build_timeout:                                 "" => "60"
  description:                                   "" => "<computed>"
  encryption_key:                                "" => "<computed>"
  environment.#:                                 "" => "1"
  environment.4086057901.compute_type:           "" => "BUILD_GENERAL1_SMALL"
  environment.4086057901.environment_variable.#: "" => "<computed>"
  environment.4086057901.image:                  "" => "aws/codebuild/ubuntu-base:14.04"
  environment.4086057901.privileged_mode:        "" => "false"
  environment.4086057901.type:                   "" => "LINUX_CONTAINER"
  name:                                          "" => "test"
  service_role:                                  "" => "<computed>"
  source.#:                                      "" => "1"
  source.1008781261.auth.#:                      "" => "0"
  source.1008781261.buildspec:                   "" => ""
  source.1008781261.git_clone_depth:             "" => "1"
  source.1008781261.insecure_ssl:                "" => ""
  source.1008781261.location:                    "" => "https://github.com/koooge/test.git"
  source.1008781261.type:                        "" => "GITHUB"

Error: Error applying plan:

1 error(s) occurred:

* aws_codebuild_project.test: 1 error(s) occurred:

* aws_codebuild_project.test: [ERROR] Error creating CodeBuild project: InvalidInputException: Service role is required
	status code: 400, request id: b26386fd-6ef5-11e8-a338-a9dceb58bb87

Output from acceptance testing:
sorry I did not run test. 🙇

[bflad]

@koooge thanks for submitting this! Admittedly, I ran into this behavior as well when re-vamping the acceptance testing for the resource recently and was confused why it was not listed as required in the CodeBuild API CreateProjectInput. I'm wondering if there is currently a valid situation when the IAM role would not be required or that maybe in the future they plan on supporting an IAM service-linked role -- let me open an AWS Support case to find out some more information.

[bflad]

I'm still waiting for an AWS Support response about this.

[bflad]

This change is looking promising, but let's wait for the service team to respond:

Thank you for having brought this discrepancy to our notice. I could observe that this property has been marked as required in the Cloudformation documentation, but is not required as per most of the other API docs. I have raised an ticket to the internal team to better understand the nature of this property as well as to ensure that the documentation is made consistent.

I shall get back to you soon as I have a response from the service team.

[bflad]

We finally received the following AWS Support response:

"Service Role is required when creating a CodeBuild Project. If you create through the console, the console may automatically create one Service Role for you just to enhance customer experience. This seems to be a documentation issue, because looking at the service role play in CodeBuild, it's required for at least sending the logs to CloudWatch Logs. The docs team has been notified of the change. In the future, the customer can always give feedback to the docs team (through the Give Feedback link). This would be helpful in getting a faster response.

Thanks for pointing out the discrepancy and for reaching out."

Thus, to reiterate, the Service Role seems to be a required property as you rightly pointed out. The documentation will also be reflected to point to the same.

Given that, let's get this merged. Thanks @koooge! 🚀

[bflad]

This has been released in version 1.27.0 of the AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!