Stack update fails due to missing permission iam:GetRole

[vvdt]

Hey,

I'm seeing more failed Stack updates, with as reason 'AccessDenied. User doesn't have permission to call iam:GetRole' on some services.

I tried to make sure my user that deploys the stack has all IAM permissions but no luck so far. Btw, I did not assign a custom IAM role to the stack, so I assume it takes the permissions of the IAM user that is running the stack.

I can't find much about the required permissions here or in Discord, so I'm a bit stuck in how to resolve this. Is there some information about hubs' permissions that I missed?

[pattersonbl2]

Are you able to Dm me in the discord your IAM user permissions? This error occurs when the IAM Users don't have the correct permissions to deploy the CF. Check your user or a user group to see if you have iam:passRole assigned. Our stack assumes have full admin rights over your ASW account.

[vvdt]

Thanks for the quick reply. I can't find your Discord name but emailed your mine on your github email. The IAM user has policies IAMFullAccess and AdministratorAccess (in that order), which both seem to include iam:passRole and iam:getRole.

[Ulriichde1st]

@pattersonbl2 @vvdt Was this issue solved if I may ask? I'm currently facing the same.

[Ritika-Nunia]

I am facing the same issue, even the IAM user has policies IAMFullAccess and AdministratorAccess include iam:passRole and iam:getRole. What I need to do? Any suggestions

[Rudy-rumbleon]

I am facing the same issue while using serverless deploy. Though user have all lambda execution permissions the cloudformation stack is returning error UPDATE_FAILED: FetchAllStoresForOpportunitiesLambdaFunction (AWS::Lambda::Function)
AccessDenied. User doesn't have permission to call iam:GetRole but the user has all the lambda execution permissions