IamInstanceProfile option ignored in create / deploy

[jonnixt17]

Description

When using .ebextensions custom configs I provide a value for the property IamInstanceProfile under the aws:autoscaling:launchconfiguration namespace. When calling eb create or eb deploy this value is ignored and instead uses the default aws-elasticbeanstalk-ec2-role role. If I edit the config via eb config and set the IamInstanceProfile property to null, it correctly sets the role according to what is in .ebextensions suggesting the config files themselves are fine.

Steps to reproduce

Any standard setup, with the addition of an .ebextensions config file including the content:

option_settings:
    aws:autoscaling:launchconfiguration:
        IamInstanceProfile: name-of-an-existing-profile

Run eb create with usual params, making sure no -ip flag is provided.

Expected result

Would expect the environment to be created or updated with the value existing in the relevant namespace option.

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: Amazon Linux 2
2. EBCLI version: 3.20.2

[florianlh]

I ran into similar issues with my projects, and this is documented behavior (although it can be surprising):

• See "Recommended values" & "Precedence" sections: https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options.html#configuration-options-recommendedvalues

[jonnixt17]

Ah yes you're right, I can see towards the bottom there are two options in that namespace that have recommended values set, though I'm unsure why this "recommended" value should override my explicit definition when creating the environment, at that point it's mandated, not recommended. Though I suppose the same goes for all of those recommended values.

Perhaps since it is documented this should be considered a feature request rather than a bug report.

[Ati59]

Same in here. And that's a big limitation to me as it defined permissions of EB's EC2 and services so it should be done everytime. Making partial IaC is useless.
In the documentation, no workaround is proposed. And using another CLI to get rid of others CLI limitations is a very poor experience. Having to use sam cli, aws cli, eb cli and web console make things really complex.