AWS Cloudformation:Template validation error Role and policy

Question

I am new to cloudformation and trying to create a template that can create a execution role and associated policies for my lambda function.

AWSTemplateFormatVersion: 2010-09-09
Description: AWS CloudFormation Template for creating iam role for SSM lambda
Parameters:
  rolename:
    Type: String
    Description: The name of the iam role for SSM Lambda
    Default: SSM_lambda_role
  policyname:
    Type: String
    Description: pcluster lambda iam policy for SSM Lambda
    Default: SSM_lambda_policy
Resources:
  ssmlambdarole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub '${rolename}'
      Description: iam role for ssm lambda role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/${policyname}'
  ssmlambdapolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Sub '${policyname}'
      Description: The name of the iam role for SSM Lambda
      Path: '/'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - logs:CreateLogGroup
          Resource: arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*
          Effect: Allow
          Sid: CloudWatchLogsPolicy
        - Action:
          - logs:CreateLogStream
          - logs:PutLogEvents
          Resource:
          - arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${policyname}:*
          Effect: Allow
          Sid: CloudWatchLogsPolicy
        - Action:
          - ssm:Describe*
          - ssm:Get*
          - ssm:List*
          Resource: "*"
          Effect: Allow

If I define a role first in the above template, I get an error during stack creation mentioning that the policy is not found and if I create policy first in the above order, I keep getting a validation error. can someone tell me where am I getting wrong.

ZabielskiGabriel · Answer

There is an attribute that can help to achieve that: DependsOn,

but the better way is to use - !Ref ssmlambdapolicy instead of - !Sub 'arn:aws:iam::${AWS::AccountId}:policy/${policyname}'.

In each case, it will establish a dependency between resources. Thanks to that AWS will be able to recognize resource creation orders - you didn't use any of them, so AWS 1stly tries to create a role (or policy, depending on the order in the template), and attach a policy that doesn't exist yet.

The validation error is due to that you missed !sub in the policy statements.

Btw, I strongly recommend looking for help in CFN documentation - sometimes there is a section with use-case examples.

userTK21 · Answer

You forgot to place !Sub in few places. It should be:

Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*"

and

            - !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${policyname}:*"

AWS Cloudformation:Template validation error Role and policy

2 Answers