我可以使用现有的AWS IAM角色通过Cloudformation模板创建S3存储桶吗？

Question

I want to create a S3 Bucket via CloudFormation template. I found there is a way to do it for EC2 instance on this link .

Do we have a way to create S3 bucket using existing IAM role via cloudformation?

Answer 1

It looks like what you're looking for is a service role . From AWS:

A service role is an AWS Identity and Access Management (IAM) role that allows AWS CloudFormation to make calls to resources in a stack on your behalf. You can specify an IAM role that allows AWS CloudFormation to create, update, or delete your stack resources. By default, AWS CloudFormation uses a temporary session that it generates from your user credentials for stack operations. If you specify a service role, AWS CloudFormation uses the role's credentials.

For more information, you might want to take a look at this , specifically the permission part to find out how to use an existing IAM role for creating a Cloudformation stack.

By the way: Unfortunately the link that you've provided doesn't seem to be accessible anymore.

Answer 2

When deploying infrastructure using creating Cloudformation template, you can have 2 ways to do it:

1. Cloudformation can deploy resources using the permissions of the current user who deploys the CF template. This is the default way
2. Secondly (Optional), you can choose an existing role that can be attached to the CF template. Cloudformation service will use the permissions of that attached role to deploy all the required services. Given that the attached role has permissions to S3, you can create an S3 bucket as can be seen in the attached screenshot