AWS Stack Update Error: Feature Required: [CAPABILITY_IAM]

Question

When creating a stack with CloudFormation, I get this error:

Stack update error: Requires capabilities : [CAPABILITY_IAM] 

I cannot find a template to add CAPABILITIES_IAM to the CloudFormation configuration.

Answer 1

Turns out you need to check the box on the last screen to create the stack | update:

In CodePipeline CloudFormation, you can add it to allow the created change_set to be executed in the deployment action:

 Configuration: StackName: !Ref GitHubRepository ActionMode: CHANGE_SET_REPLACE Capabilities: CAPABILITY_NAMED_IAM RoleArn: arn:aws:iam::818272543125:role/events-list-codepiplinerole ChangeSetName: !Join ["",[!Ref GitHubRepository, "-changeset"]] TemplatePath: MyAppBuild::sam_post.yaml 

In aws cli append

 --capabilities CAPABILITY_IAM 

or

 --capabilities CAPABILITY_NAMED_IAM 

To your team:

 aws cloudformation create-stack --stack-name message-store --template-body file://bucket_with_keys.yaml --parameters file://cfg_bucket_with_keys.json --capabilities CAPABILITY_NAMED_IAM 

This does not apply to the cloudformation --validate pattern, since it does not actually create resources.

Answer 2

If you use the AWS CLI, you can add an additional parameter to the aws cloudformation create-stack command, which explicitly states that you want to provide these features.

(this is the CLI equivalent for flagging in another answer here).

The parameter is --capabilities CAPABILITY_IAM , so your command will look like this:

aws cloudformation create-stack --stack-name $STACK_NAME --capabilities CAPABILITY_IAM

Hope that helps