Medium
CloudFormation
Regional
CloudFormation stacks should have associated service roles
Description
Flags AWS CloudFormation stacks that do not have a service role associated. Without an explicit service role, the stack uses the calling principal's permissions, which makes least-privilege control of stack operations impossible.
Remediation
Associate a least-privilege IAM service role with every CloudFormation stack.
Steps
- Create an IAM role with the minimum permissions needed to manage the stack's resources.
- Open the CloudFormation console and select the stack.
- Choose Update, then Use current template.
- Under Permissions, set the IAM role to the new service role.
- Continue through Review and submit the update.