How to pass a role to cli command “aws cloudformation deploy” or “sam deploy”?

Refresh

5 weeks ago

Views

2 time

0

I am creating a cloudformation stack using a SAM template and the CLI. I have successfully done this using an account that gets all the required permissions from policies directly attached to it. It's poor security practice to give this account all these permissions so I've created a role with the same policies attached and want to use that for deployment instead. However, even though I pass my role through the --role-arn parameter the command is still looking to the account for the permissions.

Here are the commands I've tried using:

aws cloudformation deploy --template-file TemplatePackaged.yaml --stack-name TestStack --capabilities CAPABILITY_IAM --region us-east-1 --role-arn arn:aws:iam::666488004797:role/LambdaApplicationCreateRole

or

sam deploy --template-file TemplatePackaged.yaml --stack-name TestStack --capabilities CAPABILITY_IAM --region us-east-1 --role-arn arn:aws:iam::666488004797:role/LambdaApplicationCreateRole

Unless the user logged into the cli has the required permissions I get the error with either command:

An error occurred (AccessDenied) when calling the DescribeStacks operation: User: arn:aws:iam::666488004797:user/DummyUser1 is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:us-east-1:666488004797:stack/Melissa/*

How do I get the deploy command to use the role passed in the --role-arn parameter to get the permissions it needs?

0 answers