AWS Cloud Formation.Requires capabilities : [CAPABILITY_IAM] (Child Stack)

IMPORTANT

I'm building the TemplateURL dynamically.

"TemplateURL" : { "Fn::Join" : ["", [  { "Ref" : "TemplateURL"}, "substack.template" ]] }

I'm running a CloudFormation template in the AWS Console.

Running Stack Directly

I started with a template that used IAM resources, and the console prompts me to acknowledge IAM capabilities when running the stack directly.

Running Stack as a child

I then tried to call the same stack from a parent stack and did not receive the same prompt.

The stack then failed with the message:

Requires capabilities : [CAPABILITY_IAM]

Research

The docs indicate that I can run CF scripts in a number of ways. There's plenty of docs around CLI/API and supplying the capability parameter, but there appears to be no information about how to make sure it's applied when running through the console.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html

IAM Resources in AWS CloudFormation Templates

CF Console
CLI
API

What I've done / What I think

I've raised an issue via the forum for now, but no response (yet): https://forums.aws.amazon.com/thread.jspa?threadID=139160

I suspect this is a bug in the Console, as there doesn't appear to be any documentation of how to change the behaviour via the console and as far as I'm aware this should just work.

Anyone came across the same problem, or can report that it's working fine for them?

Solution

When building the TemplateURL dynamically the validation checker cannot see if there are IAM resources in advance, and this is why it won't ask for the IAM_CAPABILITIES.

The best work around for this problem (right now) would be to create a dummy IAM resource in the master template to get the prompt.

Comments (2)

+0 – Thanks for following up with your discoveries - this seems to match previous observations of mine, but ironically we seem to encounter the inverse behavior as of recently, i.e. CAPABILITY_IAM is now always required once a sub stack resource is involved, even if it doesn't create IAM resources (e.g. the Nesting a Stack in a Template example exposes this behavior, and this happens at the API level). Unfortunately this obstructs other use cases now - has AWS contacted you about this change? — Nov 25, 2013 at 23:24
+0 – I got help through a friend but will be raising it as an official request once I get support setup for my account. — Nov 26, 2013 at 08:51

External Links

External links referenced by this document:

References

https://serverfault.com/questions/551530