Why do Amazon suggest including the region in AWS IAM resource names?

user_3092396 0
Viewed 367

IAM resources are global, meaning they aren't isolated within specific AWS regions. However, the documentation for an IAM role includes a warning:

Important

Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple regions. To prevent this, we recommend using FN::Join and AWS::Region to create a region-specific name, as in the following example ...

What kind of "unrecoverable error" are they talking about? Will cloudformation just fail to create the resource, or will things get stuck in some weird state?

The stacks we have which include IAM resources only contain IAM resources, so I suspect I may be able to ignore this warning.

amazon-cloudformation amazon-iam amazon-web-services
1 Answers

The problem they want you to be aware of is that IAM is a global namespace, which can result in problems, if you don't manually namespace resources.

Here's an example:

  • Stack 1 in eu-central-1 creates a role with the name AppAdmin
  • Stack 2 in eu-west-1 creates a role with the name AppAdmin - this stack will fail to create or update

This failure is usually nothing life-threatening, it just means, your deployment will be broken. If it's an update of an existing stack, a rollback will be performed. If it's a new stack, the stack will fail to create and you need to manually delete the stack afterwards before rolling it out again (by default the orphaned resources will be deleted).

You can simply avoid this problem by namespacing the resources as suggested:

  • Stack 1 in eu-central-1 creates a role with the name AppAdmin-eu-central-1
  • Stack 2 in eu-west-1 creates a role with the name AppAdmin-eu-west-1

Now everybody is happy!

(The same thing is true for S3 Bucket names and other resources with a global namespace)

user_64858810
Related