How do I troubleshoot IAM permission errors in CloudFormation?

Short description

When you create or update a CloudFormation stack, the action invokes API calls to the required services to provision the resources. By default, AWS CloudFormation uses a temporary session that it generates from the user credentials for stack operations. If you specify a service role, then AWS CloudFormation uses that role's credentials. The stack operation results in failure if the credentials that are used don't have the required permissions.

Resolution

To troubleshoot the IAM permission errors, follow the steps given in this section.

Error: "ExampleRole" is not authorized to perform: <AWSService>:<APIcall>."

Note: Before you begin, make sure that you are logged in to your AWS account.

To remove the error, follow these steps:

1. Go to the IAM console.
2. Choose Roles.
3. In the search bar, enter ExampleRole.
4. Choose the Permissions tab.
5. Verify the policies that are attached to the role.
6. Choose the + sign on the policy, and then choose Edit.
7. Add the missing permissions (API call) for the role policy. Then, choose Next.
8. Choose Save changes.
9. Go to the AWS CloudFormation console.
10. Redeploy the stack.

Error: "MalformedPolicyDocument" error while working with resources policies."

The above error occurs when there are syntax errors in the policy section of a CloudFormation template.

To remove the error, follow these steps:

1. Go to the AWS CloudFormation console.
2. Choose the stack where the error occurred.
3. Choose the Template tab.
4. Copy the failed policy syntax from the Template.
5. Convert the policy from YAML to JSON.
6. Go to the IAM console.
7. Choose Policies.
8. Choose Create policy.
9. In Policy editor, choose JSON.
10. Paste the policy syntax that you copied earlier into the Policy editor.
11. Choose Next. The Policy editor shows the line in the policy document with the error.
12. Correct the syntax of the policy document.
13. Choose Next. Verify that the syntax is valid.
14. Go to the AWS CloudFormation console.
15. Redeploy the stack.

Troubleshooting tips

• When the error messages from the CloudFormation stack events are unclear, look up the API calls in AWS CloudTrail for the related timestamps.
• CloudTrail API calls provide a detailed log of request parameters that were passed to the stack. The log details show the associated error messages. For more information, see Working with CloudTrail Event history.

Related information

Example of policy summaries

Editing IAM policies