AWS Instance Scheduler Template Failing

Question

I'm new to AWS but I tried to create a stack using the Instance Scheduler template so we can turn our development and staging environments off when not being used.  It fails each time when creating IAM roles.  Here is the exact error (with our org ID as all 0's):

Resource handler returned message: "Invalid principal in policy: "AWS":"arn:aws:iam::000000000000:role/default-SchedulingRequestHandler-Role" (Service: Iam, Status Code: 400, Request ID: 2b021d74-cef0-4460-a171-9c56e6f03694) (SDK Attempt Count: 1)" (RequestToken: 4e8479a6-ae9c-916f-39c7-d003c551718a, HandlerErrorCode: InvalidRequest)

re:Post Agent · Answer

It appears you're encountering an IAM-related error when trying to deploy the AWS Instance Scheduler template. This error suggests there's an issue with the IAM role specified in the policy. Here are some steps you can take to troubleshoot and resolve this issue:

1. First, ensure that you have the necessary permissions to create IAM roles and policies. The user or role you're using to deploy the stack should have sufficient IAM permissions, including the ability to create and modify roles.

2. Double-check that the AWS account ID in the ARN is correct. The error message shows all zeros, which is likely a placeholder. Make sure you're using the correct account ID in your actual deployment.

3. Verify that the role name "default-SchedulingRequestHandler-Role" exists in your account. If it doesn't, the template may be trying to reference a role that hasn't been created yet.

4. If you've previously attempted to deploy this stack, there might be leftover resources causing conflicts. Try deleting any existing resources related to the Instance Scheduler, including IAM roles, before redeploying.

5. Consider changing the "Namespace" parameter in the CloudFormation template if you're deploying in multiple regions or if you've had failed deployments before. This can help avoid naming conflicts.

6. Review the IAM policies in your account to ensure there are no restrictions preventing the creation of the required roles for the Instance Scheduler.

7. If the issue persists, you may need to manually create the IAM roles required by the Instance Scheduler before deploying the stack. You can do this through the IAM console or using AWS CLI commands.

If these steps don't resolve the issue, you may need to contact AWS support for further assistance, especially if you believe there might be account-specific restrictions or configurations causing the problem.  
**Sources**  
[(SO0030) instance-scheduler-on-aws v3.0.7 failed | AWS re:Post](https://repost.aws/questions/QUlupZdkO6Qx6jDDo8R3xF1Q/so0030-instance-scheduler-on-aws-v3-0-7-failed)  
[Resolve IAM permission errors in CloudFormation | AWS re:Post](https://repost.aws/knowledge-center/cfn-troubleshoot-iam-permission-errors)  
[How to use AWS Scheduler in multiple regions | AWS re:Post](https://repost.aws/questions/QUjdB9929_Swi5ZANkcKa5iQ/how-to-use-aws-scheduler-in-multiple-regions)

AWS Instance Scheduler Template Failing

Add your answer

Relevant content