Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

InsufficientCapabilitiesException [CAPABILITY_NAMED_IAM] when creating a stack with IAM policies

Tags:

I get this error when I run create-stack for a cloudformation template that contains IAM policies.

aws cloudformation create-stack --stack-name iam-stack --template-body file://./iam.yml --capabilities CAPABILITY_IAM --profile dev 

An error occurred (InsufficientCapabilitiesException) when calling the CreateStack operation: Requires capabilities : [CAPABILITY_NAMED_IAM]

like image 966
David Webster Avatar asked Mar 16 '18 09:03

David Webster


People also ask

What is the default CloudFormation stack policy when you create a new stack?

When you create a stack, no stack policy is set, so all update actions are allowed on all resources. To protect stack resources from update actions, define a stack policy and then set it on your stack.

What is -- capabilities Capability_iam?

This error is a security related message: it happens when you try to create a CloudFormation stack that includes the creation of IAM related resources. You have to explicitly tell CloudFormation that you are OK with that. To make it work, simply add the parameter --capabilities CAPABILITY_IAM to your deploy command.


1 Answers

Change --capabilities to CAPABILITY_NAMED_IAM

If you have IAM resources with custom names, you must specify CAPABILITY_NAMED_IAM. If you don't specify this parameter, this action returns an InsufficientCapabilities error.

https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html

like image 58
Sudharsan Sivasankaran Avatar answered Sep 21 '22 18:09

Sudharsan Sivasankaran