fix(assorted): Rare race condition and improved destroys (#494)

* fix(reindex race): Fix a rarely seen race condition where reindex kicks off before mapRole finishes, which causes a failure due to lack of permissions

* Remove createLogGroup permissions so custom resources dont recreate log groups, which is a pain when deleting and recreating a stack

src/services/data/serverless.yml

@@ -27,6 +27,10 @@ provider:
       path: /delegatedadmin/developer/
       permissionsBoundary: arn:aws:iam::${aws:accountId}:policy/cms-cloud-admin/developer-boundary-policy
       statements:
+        - Effect: Deny # Prevents delayed custom resource logs from re-creating log groups after deletion.
+          Action:
+            - logs:CreateLogGroup
+          Resource: "*"
         - Effect: "Allow"
           Action:
             - cognito-idp:AdminCreateUser
@@ -428,6 +432,7 @@ resources:
       Properties:
         ServiceToken: !GetAtt RunReindexLambdaFunction.Arn
         StateMachine: !Ref ReindexDataStateMachine
+      DependsOn: MapRole
     MapRole:
       Type: Custom::MapRole
       Properties:

src/services/ui-infra/serverless.yml

@@ -18,6 +18,10 @@ provider:
       path: /delegatedadmin/developer/
       permissionsBoundary: arn:aws:iam::${aws:accountId}:policy/cms-cloud-admin/developer-boundary-policy
       statements:
+        - Effect: Deny # Prevents delayed custom resource logs from re-creating log groups after deletion.
+          Action:
+            - logs:CreateLogGroup
+          Resource: "*"
         - Effect: "Allow"
           Action:
             - s3:ListBucketVersions

src/services/uploads/serverless.yml

@@ -21,6 +21,10 @@ provider:
       path: /delegatedadmin/developer/
       permissionsBoundary: arn:aws:iam::${aws:accountId}:policy/cms-cloud-admin/developer-boundary-policy
       statements:
+        - Effect: Deny # Prevents delayed custom resource logs from re-creating log groups after deletion.
+          Action:
+            - logs:CreateLogGroup
+          Resource: "*"
         - Effect: "Allow"
           Action:
             - s3:GetObject