Home / server / Questions / 551530
Accepted
Drew Khoury
Asked: 2013-11-08 16:54:28 +0800 CST

AWS Cloud Formation.Requires capabilities : [CAPABILITY_IAM] (Child Stack)

  • 772

IMPORTANT

I'm building the TemplateURL dynamically.

"TemplateURL" : { "Fn::Join" : ["", [  { "Ref" : "TemplateURL"}, "substack.template" ]] }

I'm running a CloudFormation template in the AWS Console.

Running Stack Directly

I started with a template that used IAM resources, and the console prompts me to acknowledge IAM capabilities when running the stack directly.

Running Stack as a child

I then tried to call the same stack from a parent stack and did not receive the same prompt.

The stack then failed with the message:

Requires capabilities : [CAPABILITY_IAM]

Research

The docs indicate that I can run CF scripts in a number of ways. There's plenty of docs around CLI/API and supplying the capability parameter, but there appears to be no information about how to make sure it's applied when running through the console.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

IAM Resources in AWS CloudFormation Templates

  • CF Console
  • CLI
  • API

What I've done / What I think

I've raised an issue via the forum for now, but no response (yet): https://forums.aws.amazon.com/thread.jspa?threadID=139160

I suspect this is a bug in the Console, as there doesn't appear to be any documentation of how to change the behaviour via the console and as far as I'm aware this should just work.

Anyone came across the same problem, or can report that it's working fine for them?

amazon-web-services

3 Answers

  1. I just ran into this issue, my problem was that I did not check the checkbox "I acknowledge that this template might cause AWS CloudFormation to create IAM resources." on the last screen before updating my stack.enter image description here

    • 6

  2. If your are using CLI or boto, you can include the "capabilities" parameter. This takes in a list, but the only accepted entry right now is 'CAPABILITY_IAM'.

    cf.update_stack(..., capabilities=['CAPABILITY_IAM'])

    or

    cf.create_stack(..., capabilities=['CAPABILITY_IAM'])

    This grants the entire stack tree IAM creation permissions.

    • 2
  3. Best Answer

    When building the TemplateURL dynamically the validation checker cannot see if there are IAM resources in advance, and this is why it won't ask for the IAM_CAPABILITIES.

    The best work around for this problem (right now) would be to create a dummy IAM resource in the master template to get the prompt.

    • 1