CODEWITHSUNDEEP
jsonrolesaws-cloudformationamazon-iam
JavaQueen
JavaQueen

Reputation: 1185

Error in the policyName when creating IAM Role by cloudformation

This is the role snippet: 

"InstanceRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Version" : "2012-10-17",
      "Statement": [ {
        "Effect": "Allow",
        "Principal": {
           "Service" : [ { "Fn::FindInMap": [ "Region2Principal", { "Ref": "AWS::Region" },"EC2Principal" ] } ] },
        "Action"  : [ "sts:AssumeRole" ]
      }]
    },
    "Path": "/",
    "Policies": [{
      "PolicyName": {"Fn::Join" : ["",["AWS::StackName","InstanceApi"] ] },
      "PolicyDocument": {
        "Statement": [{
          "Effect": "Allow",
          "Action": "*",
          "Resource": "*"
        }]
      }
    }]
  }
},

This is the error : The specified value for policyName is invalid. It must contain only alphanumeric characters and/or the following: +=,.@_-

The value of AWS::StackName I entered is tmplt-stack , and the generated policy name that gives error is : tmplt-stack-InstanceApi-O7KF5OL0TA2Q

I don't understand why cloudformation denies the name even that it only contain few characters of '-' and it's allowed according to the error message and the rest are all alphanumeric characters.

Upvotes: 4

Views: 8406

Answers (1)

JavaQueen
JavaQueen

Reputation: 1185

This is the huge mistake I made when I used the pseudo parameter AWS::StackName, I didn't call it with Ref

"InstanceRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Version" : "2012-10-17",
      "Statement": [ {
        "Effect": "Allow",
        "Principal": {
           "Service" : [ { "Fn::FindInMap": [ "Region2Principal", { "Ref": "AWS::Region" },"EC2Principal" ] } ] },
        "Action"  : [ "sts:AssumeRole" ]
      }]
    },
    "Path": "/",
    "Policies": [{
      "PolicyName": {"Fn::Join" : ["",[{"Ref":"AWS::StackName"},"InstanceApi"] ] },
      "PolicyDocument": {
        "Statement": [{
          "Effect": "Allow",
          "Action": "*",
          "Resource": "*"
        }]
      }
    }]
  }
},

Upvotes: 7

Related Questions