All checks
Medium
CloudFormation stacks should have associated service roles
Flags AWS CloudFormation stacks that do not have a service role associated. Without an explicit service role, the stack uses the calling principal's permissions, which makes least-privilege control of stack operations impossible.
- service
- CloudFormation
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Associate a least-privilege IAM service role with every CloudFormation stack.
- Create an IAM role with the minimum permissions needed to manage the stack's resources.
- Open the CloudFormation console and select the stack.
- Choose Update, then Use current template.
- Under Permissions, set the IAM role to the new service role.
- Continue through Review and submit the update.
See which of your accounts this check is failing on.
Book a demo