IAM role inside SAM template

Question

How to create an IAM role inside a SAM template likewise I did in SAM package. I tried this as following:

"lambdaFunctionRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com",
                  "apigateway.amazonaws.com"
                ]
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "ManagedPolicyArns": [
          {
            "Ref": "lambdaBasePolicy"
          }
        ],
        "Policies": [
          {
            "PolicyName": "root",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents"
                  ],
                  "Resource": "arn:aws:logs:*:*:*"
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:*",
                    "dynamodb:*",
                    "iam:ListRoles",
                    "ses:*",
                    "events:*"
                  ],
                  "Resource": "*"
                }
              ]
            }
          }
        ]
      }
    }

It throws me an error : com.amazonaws.serverlessappsrepo.template.InvalidTemplateException: Resource with name [lambdaFunctionRole] is invalid. AWS::Serverless::Role is not a supported Serverless Apps Repository Type.

Answer 1

When publishing to the Serverless app repo, you need to take care to use only the supported resources in you SAM template.

In your case, you can skip creating the lambdaFunctionRole as a standalone resource and just create it inline in your function resource definition.

"lambdaFunction": {
  "Type": "AWS::Serverless::Function",
  "Policies": [
    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ],
          "Resource": "arn:aws:logs:*:*:*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:*",
            "dynamodb:*",
            "iam:ListRoles",
            "ses:*",
            "events:*"
          ],
          "Resource": "*"
        }
      ]
    }
  ]
}

Notice that I've only copied the PolicyDocument part of the Policies in the Role. See the Policies section in the SAM spec.