How to avoid duplicate IAM roles when deploying stackset to multiple regions

0

Scenario:

I'm deploying a cloudformation template to automate action in response to a Cloudwatch event rule. The template creates:

  1. IAM Role - Lambda Execution
  2. Lambda Function - Remediation
  3. Events Rule - Trigger Lambda
  4. Lambda Permission - Events can Invoke Lambda

Problem:

When deploying this solution to multiple regions via stackset it results in duplicate IAM roles being created. This seems unnecessary.

Question:

How, if possible, might I go about creating the IAM role once per account and having each region's lambda use that single role within the same stackset?

AWS
Jon
질문됨 4년 전1174회 조회
1개 답변
0
수락된 답변

My approach has been: tie the role to the "thing" that consumes/needs it, centralizing might seem good but can be dangerous because of a larger impact.

If you're using StackSets, why not set one region as your "main" one and create a condition on the IAM role that only creates it within that region. This way you can still use a single StackSet but only have one IAM role.

Otherwise, you could setup roles within another stack, turn on termination protection and export it's ARN. Something like `FunctionalityX-Lambda-RoleArn".

Personally I try avoid custom resources where they aren't required, especially if you see potentially a lot of updates/changes.

AWS
전문가
Raphael
답변함 4년 전
profile picture
전문가
검토됨 3일 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠