starsnow_request
starsnow_request copied to clipboard
starschema
iam:CreateRole fails with an explicit deny
When you deploy the project into an environment that uses AWS permissions boundaries (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html) it fails with a role creation error. In my case, Roles could only be created with permissions boundaries applied. Since permissions boundaries are specific to the customer environment, I am not sure if this can be fixed in a generic sense. In my case I was able to fix the problem by setting the rolePermissionsBoundary attribute for the provider in the serverless yaml configuration file:
provider: ... RolePermissionsBoundary: ....
Maybe it would be a good idea just to mention this in the documentation.
Another suggestion for a documentation enhancement is to mention the AWS permissions needed for this project:
- IAM
- S3
- CloudFormation
- APIGateway
BTW, this is an excellent post. Really enjoyed it.
Hi Robert, I will include it in the documentation. Also, I will link this Serverless policy generator as well: https://open-sl.github.io/serverless-permission-generator/ , probably that will be enough.
