Justin Plock

@revmischa for the data API, you can recreate the ARN if you provide the DBClusterIdentifier property like https://github.com/smoketurner/serverless-vpc-plugin/blob/master/example/serverless.yml#L59

@sriram-mv correct, but if it needs to bootstrap the S3 bucket, the role_arn does not get used.

@sriram-mv the CloudFormation role we are using isn't assume-able by users, it's a service role, so I don't think what you proposed would work

@sriram-mv thoughts on including https://github.com/awslabs/aws-sam-cli/pull/1933 in an upcoming release? It would simplify our getting started activities

Have you tried creating the policy in us-east-1?

4.0 also seems to be in progress with a move to GRPC and protocol buffers.

Related to this, I created a SAM project called https://github.com/smoketurner/sam-cdn and is available within the Serverless Application Repository at https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:860114833029:applications~cloudfront-cdn that aims to simplify this pattern I was repeating over...

Would you accept a PR for this?

@keetonian yes, correct. We have policies in place to allow teams to only create IAM roles via CloudFormation templates if they provide a specific CF service role. The service role...

Great, happy to work on that.