Can someone help me find a solution to this circular dependency?
And explain why this error occurs?
The cloudformation error i’m getting.
Circular dependency between resources: [AddUserToGroup, AWSConfigStrorageBucket, AWSConfigRecorder, SystemsAuditorGroup, SystemAuditorGroupPolicy]
The cloud formation template that is erroring.
AWSTemplateFormatVersion: "2010-09-09"
Description: >
A stack that install stystems auditing using AWS Config, creates the nessecary resources, and assignes your system auditor access.
Parameters:
SystemsAuditor:
Description: An AWS User who should have access to all your organazations resources list and the data.
Type: String
CreatedBy:
Description: Enter your Admin User Arn
Type: String
Resources:
AWSConfigRecorder:
Type: AWS::Config::ConfigurationRecorder
Properties:
Name: Account Inventory
RecordingGroup:
RecordingStrategy:
UseOnly: ALL_SUPPORTED_RESOURCE_TYPES
Destination: !Ref AWSConfigStrorageBucket
RecordingMode:
RecordingFrequency: CONTINUOUS
DependsOn: AWSConfigStrorageBucket
AWSConfigStoredQuery:
Type: AWS::Config::StoredQuery
Properties:
QueryDescription: Select all resources created
QueryExpression: "SELECT resourceId, resourceType, tag.CreatedBy"
QueryName: SelectAll
Tags:
- Key: "CreatedBy"
Value: !Ref CreatedBy
AWSConfigStrorageBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: '$Account_Audit_{!Ref AWS::AccountId}'
Tags:
- Key: "CreatedBy"
Value: !Ref CreatedBy
DependsOn: SystemAuditorGroupPolicy
SystemsAuditorGroup:
Type: AWS::IAM::Group
Properties:
GroupName: System Auditor
Policies:
- !Ref SystemAuditorGroupPolicy
DependsOn: SystemAuditorGroupPolicy
SystemAuditorGroupPolicy:
Type: AWS::IAM::Policy
Properties:
Groups:
- !Ref SystemsAuditorGroup
PolicyDocument:
Version: 2012-10-17
Statement:
- Sid: AWSConfig
Effect: Allow
Action:
- config:ListStoredQueries
- config:ListTagsForResource
Resource:
- !Ref AWSConfigRecorder
- !Ref AWSConfigStoredQuery
- Sid: AWSConfigData
Effect: Allow
Action:
- s3:GetObject
- s3:ListBucket
Resource:
- !Ref AWSConfigStrorageBucket
Condition: {"Bool": {"aws:MultiFactorAuthPresent": "true"}}
PolicyName: SystemAuditorGroup
AddUserToGroup:
Type: AWS::IAM::UserToGroupAddition
Properties:
GroupName: !Ref SystemsAuditorGroup
Users:
- !Ref SystemsAuditor
DependsOn: SystemsAuditorGroup
I initially let Cloudformation choose the order of installation without the DependsOn: property.
Then I added the DependsOn property and got the same error.