AWS::RDS::DBInstance 不是从 cloudformation 创建的

Question

This is my cloudformation json code to create DBInstance. I have successfully created VPC and EC2 instances and added this code to create DBInstance. But I am having following error while updating my stack with new json file including this DBInstance code.

Unable to create the resource. Verify that you have permission to create service linked role. Otherwise wait and try again later (Service: AmazonRDS; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 1b64b02f-255a-4f5d-b68a-b0bacf6f2dba)

"myDBInstance" : {
  "Type" : "AWS::RDS::DBInstance",
  "Properties" : {
    "DBName" : { "Ref" : "DBName"},
    "AllocatedStorage" : "20",
    "DBInstanceClass" : { "Ref" : "DBInstanceClass"},
    "Engine" : "MySQL",
    "EngineVersion" : "5.7.17",
    "MasterUsername" : { "Ref" : "DBUser"},
    "MasterUserPassword" : { "Ref" : "DBPassword"},
    "DBParameterGroupName" : { "Ref" : "myRDSParameterGroup"}
  }
},
"myRDSParameterGroup" : {
  "Type" : "AWS::RDS::DBParameterGroup",
  "Properties" : {
    "Family" : "MySQL5.6",
    "Description" : "Cloudformation database parameter group",
    "Parameters" : {
      "autocommit" : "1",
      "general_log" : "1",
      "old_passwords" : "0"
    }
  }
}

enter image description here

Answer 1

AWS answers this specifically for RDS in their docs: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAM.ServiceLinkedRoles.html

{
    "Action": "iam:CreateServiceLinkedRole",
    "Effect": "Allow",
    "Resource": "arn:aws:iam::*:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS",
    "Condition": {
        "StringLike": {
            "iam:AWSServiceName":"rds.amazonaws.com"
        }
    }
}

Answer 2

I was facing the same issue earlier, actually, the response says itself whats the problem.
"Unable to create the resource. Verify that you have permission to create service linked role. "

Means the IAM user your using to create this resource doesn't have permission to create service linked role, So you need to add this permission to your IAM user policy as follows.

Solution:

{
   "Effect": "Allow",
   "Action": "iam:CreateServiceLinkedRole",
   "Resource": "*"
}