Using Existing Role in CloudFormation Template

Question

I'm trying to use an existing IAM role in a CFN template that is already being used by other services.

The Resource definition looks like this:

MyInstanceProfile:
  Type: "AWS::IAM::InstanceProfile"
  Properties: 
    Path: "/"
    Roles: ["Capras999"]

And I'm referencing it like this:

LambdaFunction:
  Type: AWS::Lambda::Function
  Properties:
    Role: !Ref MyInstanceProfile

However I get this error:

1 validation error detected: Value 'capras-cluster-Prsr-DL-with-params-MyInstanceProfile-1R68JNUXU0SAA' at 'role' failed to satisfy constraint: Member must satisfy regular expression pattern: arn:(aws[a-zA-Z-]*)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+ (Service: AWSLambdaInternal; Status Code: 400; Error Code: ValidationException; Request ID: 5f75a56d-8ce4-473e-924e-626a5d3aab0a)

What am I doing wrong? Please help me.

user_248823 · Answer

For lambda function you need role not instance-profile.

The solution was to copy and paste an existing role's ARN into the template. Other possibility is to pass it in using a parameter.

p.s.

Generally, you need to define AWS::IAM::Role with a thrust policy for lambda. For example:

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
        RoleName: my-lambda-execution-role
        AssumeRolePolicyDocument:
          Version: '2012-10-17'               
          Statement:
            - Effect: Allow
              Principal: {'Service': ['lambda.amazonaws.com']}
              Action: ['sts:AssumeRole']
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AWSLambdaExecute

Then for your function you would do:

LambdaFunction:
  Type: AWS::Lambda::Function
  Properties:
    Role: !GetAtt LambdaExecutionRole.Arn

user_13460933 · Answer

You are specifying the instance name as the value, this parameter should instead be the Arn of the IAM role in question.

From your question you're trying to attach an instance profile to your Lambda, these are for EC2 instances only. Instead you want the Arn of the role itself.

From the console you can get the Arn for IAM role Capras999.

If you're using an existing role make sure to update your AssumeRolePolicy to also include lambda.amazonaws.com (and lambdaedge.amazonaws.com if using it for Lambda@Edge).

Using Existing Role in CloudFormation Template

2 Answers