How to set Cloudformation full access from the serverless cli

Question

I have programatic access to an aws account and when I try to deploy the a basic function, I get:

User: arn:aws:iam::xxxx:user/myname is not authorized to perform: cloudformation:DescribeStacks on resource: arn:aws:cloudformation:eu-west-1:xxxxxx:stack/hello-world-dev/*

I checked my keys and they are correct, I assume my user does not have cloudformation access.

My question is, is it possible to set the permissions for my user in the yaml file? For example cloudformation full access, lambda full access, etc.

You can find my functiona and yaml file bellow:

handler.js

module.exports.helloWorld = (event, context, callback) => {
  const response = {
    statusCode: 200,
    headers: {
      'Access-Control-Allow-Origin': '*', // Required for CORS support to work
    },
    body: JSON.stringify({
      message: 'Go Serverless v1.0! Your function executed successfully!',
      input: event,
    }),
  };

  callback(null, response);
};

serverless.yaml

service: hello-world

provider:
  name: aws
  runtime: nodejs8.10
  region: eu-west-1
  # iamRoleStatements:
  #   - Effect: "Allow"
  #     Action:
  #      - cloudformation: CreateStack
  #      - cloudformation: DescribeStacks
  #      - cloudformation: CreateChangeSet
  #      - cloudformation: ListStacks
  #      - cloudformation: UpdateStack
  #      - cloudformation: DescribeChangeSet
  #      - cloudformation: ExecuteChangeSet
  #      - iam: GetRole
  #      - lambda: UpdateFunctionCode
  #      - lambda: UpdateFunctionConfig
  #      - lambda: GetFunctionConfiguration
  #      - lambda: AddPermission
  #      - s3: GetObject
  #     Resource: "*"

# The `functions` block defines what code to deploy
functions:
  helloWorld:
    handler: handler.helloWorld
    # The `events` block defines how to trigger the handler.helloWorld code
    events:
      - http:
          path: hello-world
          method: get
          cors: true

score 5 · Answer 1 · answered Sep 17 '18 at 18:58

So the problem here is your default ~/.aws/credentials keys don't have the correct permissions assigned to them.

You can't assign permissions in the yaml file for your user, you need to head over into the console and assign, you can create users in the resources section but that's going to be counter intuitive - I'm not quite sure what your knowledge level is so if you need more help please comment and I'll flesh out my answer.

Your deployment role/permissions should basically have Lambda, IAM, Cloudformation and APIG full access.

How to set Cloudformation full access from the serverless cli

1 Answers1