Giters

alexcasalboni / aws-lambda-power-tuning

AWS Lambda Power Tuning is an open-source tool that can help you visualize and fine-tune the memory/power configuration of Lambda functions. It runs in your own AWS account - powered by AWS Step Functions - and it supports three optimization strategies: cost, speed, and balanced.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Unable to deploy (not authorized to perform iam:CreateRole)

jp-chl opened this issue · comments

commented

Hi,
I'm trying to deploy either by using SAM or with AWS Serverless Application Repository with no luck.

I'm using an AWS account with full Owner permissions, however, all the template roles (analyzerRole, optimizerRole, executorRole) failed in CloudFormation with the following error: "API: iam:CreateRole User: arn:aws:sts::xxxxxx:assumed-role/Owner/myemail@domain.com is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::xxxxxx:role/serverlessrepo-aws-lambda-power-tunin-analyzerRole-30U2WSAK4KID with an explicit deny"

The previous events in CloudFormation show:

  • LogicalId: analyzerRole, Status reason: Did not have IAM permissions to process tags on AWS::IAM::Role resource.
  • LogicalId: executorRole, Status reason: Did not have IAM permissions to process tags on AWS::IAM::Role resource.
  • LogicalId: optimizerRole, Status reason: Did not have IAM permissions to process tags on AWS::IAM::Role resource.

Is there any workaround or CloudFormation template suggestion to overcome this issue?

Thanks in advance

commented

Hi @jp-chl, thanks for reporting!

It looks like your role can create IAM roles but lacks permissions to tag IAM roles.

You'll need to enable the tag:TagResource action, as well as iam:ListRoleTags and iam:TagRole (more details here and here).

This is required because SAR automatically tags your IAM Roles with the app version and app id (see screenshot below).

Screenshot 2022-01-20 at 09 41 31

If your role already has full permissions, make sure there isn't any explicit deny somewhere else (for example, in a Service Control Policy at the account level).

commented

Thank you very much!
I've tried with a root account and works well.

Will keep looking in IAM. Thanks!

commented

Great, thanks for the update 🙏

I'm going to close this issue then :)

Let me know if you encounter other issues with IAM, feel free to reopen this issue.