Include iam:CreateServiceLinkedRole permissions on create handlers (#465

) Co-authored-by: Diogo Henriques <[email protected]> Co-authored-by: moataz-mhmd <[email protected]>
aws-cloudformation · Sep 28, 2023 · 71ea68c · 71ea68c
1 parent 65307fd
commit 71ea68c
Show file tree

Hide file tree

Showing 12 changed files with 12 additions and 0 deletions.
diff --git a/aws-rds-dbcluster/aws-rds-dbcluster.json b/aws-rds-dbcluster/aws-rds-dbcluster.json
@@ -462,6 +462,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "iam:PassRole",
         "rds:AddRoleToDBCluster",
         "rds:AddTagsToResource",

diff --git a/aws-rds-dbcluster/resource-role.yaml b/aws-rds-dbcluster/resource-role.yaml
@@ -31,6 +31,7 @@ Resources:
               - Effect: Allow
                 Action:
                 - "ec2:DescribeSecurityGroups"
+                - "iam:CreateServiceLinkedRole"
                 - "iam:PassRole"
                 - "rds:AddRoleToDBCluster"
                 - "rds:AddTagsToResource"

diff --git a/aws-rds-dbclusterparametergroup/aws-rds-dbclusterparametergroup.json b/aws-rds-dbclusterparametergroup/aws-rds-dbclusterparametergroup.json
@@ -73,6 +73,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "rds:AddTagsToResource",
         "rds:CreateDBClusterParameterGroup",
         "rds:DescribeDBClusterParameterGroups",

diff --git a/aws-rds-dbclusterparametergroup/resource-role.yaml b/aws-rds-dbclusterparametergroup/resource-role.yaml
@@ -30,6 +30,7 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                - "iam:CreateServiceLinkedRole"
                 - "rds:AddTagsToResource"
                 - "rds:CreateDBClusterParameterGroup"
                 - "rds:DeleteDBClusterParameterGroup"

diff --git a/aws-rds-dbparametergroup/aws-rds-dbparametergroup.json b/aws-rds-dbparametergroup/aws-rds-dbparametergroup.json
@@ -74,6 +74,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "rds:AddTagsToResource",
         "rds:CreateDBParameterGroup",
         "rds:DescribeDBParameterGroups",

diff --git a/aws-rds-dbparametergroup/resource-role.yaml b/aws-rds-dbparametergroup/resource-role.yaml
@@ -30,6 +30,7 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                - "iam:CreateServiceLinkedRole"
                 - "rds:AddTagsToResource"
                 - "rds:CreateDBParameterGroup"
                 - "rds:DeleteDBParameterGroup"

diff --git a/aws-rds-dbsubnetgroup/aws-rds-dbsubnetgroup.json b/aws-rds-dbsubnetgroup/aws-rds-dbsubnetgroup.json
@@ -72,6 +72,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "rds:CreateDBSubnetGroup",
         "rds:DescribeDBSubnetGroups",
         "rds:AddTagsToResource",

diff --git a/aws-rds-dbsubnetgroup/resource-role.yaml b/aws-rds-dbsubnetgroup/resource-role.yaml
@@ -30,6 +30,7 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                - "iam:CreateServiceLinkedRole"
                 - "rds:AddTagsToResource"
                 - "rds:CreateDBSubnetGroup"
                 - "rds:DeleteDBSubnetGroup"

diff --git a/aws-rds-eventsubscription/aws-rds-eventsubscription.json b/aws-rds-eventsubscription/aws-rds-eventsubscription.json
@@ -90,6 +90,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "rds:CreateEventSubscription",
         "rds:DescribeEventSubscriptions",
         "rds:ListTagsForResource",

diff --git a/aws-rds-eventsubscription/resource-role.yaml b/aws-rds-eventsubscription/resource-role.yaml
@@ -30,6 +30,7 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                - "iam:CreateServiceLinkedRole"
                 - "rds:AddSourceIdentifierToSubscription"
                 - "rds:AddTagsToResource"
                 - "rds:CreateEventSubscription"

diff --git a/aws-rds-optiongroup/aws-rds-optiongroup.json b/aws-rds-optiongroup/aws-rds-optiongroup.json
@@ -145,6 +145,7 @@
   "handlers": {
     "create": {
       "permissions": [
+        "iam:CreateServiceLinkedRole",
         "rds:AddTagsToResource",
         "rds:CreateOptionGroup",
         "rds:DescribeOptionGroups",

diff --git a/aws-rds-optiongroup/resource-role.yaml b/aws-rds-optiongroup/resource-role.yaml
@@ -30,6 +30,7 @@ Resources:
             Statement:
               - Effect: Allow
                 Action:
+                - "iam:CreateServiceLinkedRole"
                 - "rds:AddTagsToResource"
                 - "rds:CreateOptionGroup"
                 - "rds:DeleteOptionGroup"