{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/convection/issues/64","labels_url":"https://api.github.com/repos/rapid7/convection/issues/64/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/convection/issues/64/comments","events_url":"https://api.github.com/repos/rapid7/convection/issues/64/events","html_url":"https://github.com/rapid7/convection/pull/64","id":116343062,"number":64,"title":"Ensure securerandom is required.  Also do not pass empty Resources ar…","user":{"login":"simonirwin-r7","id":12156460,"avatar_url":"https://avatars.githubusercontent.com/u/12156460?v=3","gravatar_id":"","url":"https://api.github.com/users/simonirwin-r7","html_url":"https://github.com/simonirwin-r7","followers_url":"https://api.github.com/users/simonirwin-r7/followers","following_url":"https://api.github.com/users/simonirwin-r7/following{/other_user}","gists_url":"https://api.github.com/users/simonirwin-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/simonirwin-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonirwin-r7/subscriptions","organizations_url":"https://api.github.com/users/simonirwin-r7/orgs","repos_url":"https://api.github.com/users/simonirwin-r7/repos","events_url":"https://api.github.com/users/simonirwin-r7/events{/privacy}","received_events_url":"https://api.github.com/users/simonirwin-r7/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-11-11T14:17:09Z","updated_at":"2015-11-11T16:52:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/convection/pulls/64","html_url":"https://github.com/rapid7/convection/pull/64","diff_url":"https://github.com/rapid7/convection/pull/64.diff","patch_url":"https://github.com/rapid7/convection/pull/64.patch"},"body":"…ray in policy as CF with reject it\r\n\r\nFirst - sometimes Convection fails as securerandom is not loaded.\r\n\r\nSecond, this template used to work:\r\n\r\n```\r\nmodule IAM\r\n  IAM = Convection.template do\r\n    description 'Something useful'\r\n\r\n    iam_role 'MyRole' do\r\n      path \"/my/path\"\r\n      trust_ec2_instances\r\n    end\r\n  end\r\nend\r\n```\r\n\r\nIt generates this JSON:\r\n\r\n```javascript\r\n{\r\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\r\n  \"Description\": \"Something useful\",\r\n  \"Parameters\": {\r\n  },\r\n  \"Mappings\": {\r\n  },\r\n  \"Conditions\": {\r\n  },\r\n  \"Resources\": {\r\n    \"MyRole\": {\r\n      \"Type\": \"AWS::IAM::Role\",\r\n      \"Properties\": {\r\n        \"Path\": \"/my/path\",\r\n        \"AssumeRolePolicyDocument\": {\r\n          \"Version\": \"2012-10-17\",\r\n          \"Statement\": [\r\n            {\r\n              \"Effect\": \"Allow\",\r\n              \"Action\": [\r\n                \"sts:AssumeRole\"\r\n              ],\r\n              \"Resource\": [\r\n              \r\n              ],\r\n              \"Principal\": {\r\n                \"Service\": \"ec2.amazonaws.com\"\r\n              }\r\n            }\r\n          ]\r\n        }\r\n      }\r\n    }\r\n  },\r\n  \"Outputs\": {\r\n  }\r\n}\r\n```\r\n\r\nYesterday this started to fail for me, with CF reporting the following:\r\n```\r\n    converge  Stack iam\r\ncreate_in_progress  sirwin-cloud-iam: (AWS::CloudFormation::Stack/arn:aws:cloudformation:us-east-1:716756199562:stack/sirwin-cloud-iam/5c60c210-887e-11e5-a8f7-500150b34c7c) User Initiated\r\ncreate_in_progress  MyRole: (AWS::IAM::Role/) \r\ncreate_failed  MyRole: (AWS::IAM::Role/) Has prohibited field Resource\r\n```\r\n\r\nWith the code change, we will remove the `Resources` array if it is empty.  The resulting JSON looks like:\r\n\r\n```javascript\r\n{\r\n  \"AWSTemplateFormatVersion\": \"2010-09-09\",\r\n  \"Description\": \"Something useful\",\r\n  \"Parameters\": {\r\n  },\r\n  \"Mappings\": {\r\n  },\r\n  \"Conditions\": {\r\n  },\r\n  \"Resources\": {\r\n    \"MyRole\": {\r\n      \"Type\": \"AWS::IAM::Role\",\r\n      \"Properties\": {\r\n        \"Path\": \"/my/path/\",\r\n        \"AssumeRolePolicyDocument\": {\r\n          \"Version\": \"2012-10-17\",\r\n          \"Statement\": [\r\n            {\r\n              \"Effect\": \"Allow\",\r\n              \"Action\": [\r\n                \"sts:AssumeRole\"\r\n              ],\r\n              \"Principal\": {\r\n                \"Service\": \"ec2.amazonaws.com\"\r\n              }\r\n            }\r\n          ]\r\n        }\r\n      }\r\n    }\r\n  },\r\n  \"Outputs\": {\r\n  }\r\n}\r\n```\r\n\r\nI'm not sure why this hasn't failed before now; I have deployed templates using this exact format for some weeks now."},"comment":{"url":"https://api.github.com/repos/rapid7/convection/issues/comments/155843949","html_url":"https://github.com/rapid7/convection/pull/64#issuecomment-155843949","issue_url":"https://api.github.com/repos/rapid7/convection/issues/64","id":155843949,"user":{"login":"jmanero-r7","id":8549280,"avatar_url":"https://avatars.githubusercontent.com/u/8549280?v=3","gravatar_id":"","url":"https://api.github.com/users/jmanero-r7","html_url":"https://github.com/jmanero-r7","followers_url":"https://api.github.com/users/jmanero-r7/followers","following_url":"https://api.github.com/users/jmanero-r7/following{/other_user}","gists_url":"https://api.github.com/users/jmanero-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jmanero-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jmanero-r7/subscriptions","organizations_url":"https://api.github.com/users/jmanero-r7/orgs","repos_url":"https://api.github.com/users/jmanero-r7/repos","events_url":"https://api.github.com/users/jmanero-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jmanero-r7/received_events","type":"User","site_admin":false},"created_at":"2015-11-11T16:52:02Z","updated_at":"2015-11-11T16:52:02Z","body":":+1: "}}