IoT DescribeRoleAlias denied from CloudFormation

Question

What I'm trying to do:
- From a GitHub Action, create/update a CloudFormation stack with a template
- Use the CloudFormation template to generate the needed resources for fleet provisioning with IoT Greengrass (https://docs.aws.amazon.com/greengrass/v2/developerguide/fleet-provisioning-setup.html):
	- token exchange IAM role
	- policy for that role
	- role alias (got stuck here)
	- not there yet: a fleet provisioning template

When the stack gets created, it hits `CREATE_FAILED` on the `AWS::IoT::RoleAlias`:
```
Resource handler returned message: "Access denied for operation 'DescribeRoleAlias'." (RequestToken: *****, HandlerErrorCode: AccessDenied)
```

I see the role alias in the IoT Core console, and I see the successful `CreateRoleAlias` call in CloudTrail, but something around the permissions of `DescribeRoleAlias` appears to be lacking.

The policy in use by the GitHub Action:
```
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"cloudformation:ListStacks",
				"cloudformation:CreateStack",
				"cloudformation:CreateChangeSet",
				"cloudformation:DescribeChangeSet",
				"cloudformation:ExecuteChangeSet",
				"cloudformation:DeleteChangeSet",
				"cloudformation:DescribeStacks"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": [
				"iam:GetRole",
				"iam:DeleteRolePolicy",
				"iam:CreateRole",
				"iam:DeleteRole",
				"iam:PutRolePolicy",
				"iam:GetRolePolicy"
			],
			"Resource": "*"
		},
		{
			"Effect": "Allow",
			"Action": "iam:PassRole",
			"Resource": "*",
			"Condition": {
				"StringEquals": {
					"iam:PassedToService": "iot.amazonaws.com"
				}
			}
		},
		{
			"Effect": "Allow",
			"Action": [
				"iot:CreateRoleAlias",
				"iot:DeleteRoleAlias",
				"iot:DescribeRoleAlias",
				"iot:UpdateRoleAlias"
			],
			"Resource": "*"
		}
	]
}
```

The CloudFormation template:
```
AWSTemplateFormatVersion: "2010-09-09"

Resources:
  MyGreengrassV2TokenExchangeRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - credentials.iot.amazonaws.com
            Action:
              - sts:AssumeRole
  MyGreengrassV2TokenExchangeRoleAccess:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: MyGreengrassV2TokenExchangeRoleAccess
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - logs:DescribeLogStreams
              - s3:GetBucketLocation
            Resource: "*"
      Roles:
        - !Ref MyGreengrassV2TokenExchangeRole
  MyGreengrassCoreTokenExchangeRoleAlias:
    Type: AWS::IoT::RoleAlias
    Properties:
      RoleArn: !GetAtt MyGreengrassV2TokenExchangeRole.Arn
      RoleAlias: MyGreengrassCoreTokenExchangeRoleAlias
```

Additional notes:
- Is there some way for me to view more details about why `DescribeRoleAlias` is being denied?
- I get the same exact failure when I remove `iot:DescribeRoleAlias` from the policy used by the GitHub Action; its presence doesn't seem to have any effect.
- Is this related to `iam:PassRole`?

What's missing?

Accepted Answer

Hi,

I have performed testings with the same IAM policy and CloudFormation stack and can replicate the permission error. While looking at CloudTrail, I have found the following log for my IAM role iot-cloudformation:

```
"errorMessage": "User: arn:aws:sts::123456789012:assumed-role/iot-cloudformation/AWSCloudFormation is not authorized to perform: iot:ListTagsForResource on resource: arn:aws:iot:us-east-1:123456789012:rolealias/MyGreengrassCoreTokenExchangeRoleAlias because no identity-based policy allows the iot:ListTagsForResource action",
```

Therefore, when CloudFormation manages the IOT role alias resource, it sends an iot:ListTagsForResource event as well. With the following IAM policy, the CloudFormation creation has passed:

```
        {
            "Effect": "Allow",
            "Action": [
                "iot:CreateRoleAlias",
                "iot:DeleteRoleAlias",
                "iot:DescribeRoleAlias",
                "iot:UpdateRoleAlias",
                "iot:ListTagsForResource"
            ],
            "Resource": "*"
        }
```

IoT DescribeRoleAlias denied from CloudFormation

Relevant content