[Quick Tip] I Tested How the IAM Role Names Automatically Generated by CloudFormation Are Truncated When the Stack Name or Logical ID Is Long

Hello, this is Hayashi.

When you create an IAM role in CloudFormation without specifying RoleName, a name in the format <stack name>-<logical ID>-<random string> is generated automatically.

I checked how the name is generated when the stack name and logical ID are long and the name exceeds the IAM role name limit of 64 characters.

Conclusion First

• The stack name and logical ID used in the role name total at most 50 characters
• If both the stack name and the logical ID exceed 25 characters, the first 25 characters of each are used
• If you specify role/<stack name>-* in the Resource of an IAM policy, roles whose stack names have been truncated will not match, so either keep the stack name to 25 characters or fewer, or specify RoleName

What the Documentation Tells Us

The documentation states that the automatically generated name is a combination of the stack name, the logical ID, and a unique ID.
It also states that the limit for RoleName is 64 characters.
I could not confirm from the documentation which parts are used, and how many characters of each, when the limit is exceeded.

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/resources-section-structure.html

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html

Verification Method

I tested AWS::IAM::Role in the Tokyo region.

I prepared a template that defines five IAM roles without specifying RoleName.

From this template, I created five stacks with different stack name lengths.

I checked the role names with describe-stack-resources.

aws cloudformation describe-stack-resources --stack-name dev-app-common \
  --query 'StackResources[].[LogicalResourceId,PhysicalResourceId]' --output text

Results

In every case, the role name was in the format <stack name>-<logical ID>-<random 12 characters>.
Two hyphens plus 12 random characters make 14 characters, so the stack name and logical ID use at most 50 characters in total.

The results for each combination are below.
They show which side was truncated and the number of characters after truncation.

Examples of Truncated Role Names

With a 26-character stack name and a 25-character logical ID, the last character of the stack name was truncated.

スタック名: prod-order-api-application
ロール名:   prod-order-api-applicatio-OrderApiTaskExecutionRole-9w02y8Ta3WrL

When the 25th character of the stack name is a hyphen, two consecutive hyphens appeared.

スタック名: stg-order-management-api-ecs-service-deploy-pipeline
ロール名:   stg-order-management-api--OrderApiTaskExecutionRole-IfDGwdvtuFnP

Caveats When Specifying Roles with Wildcards in IAM Policies

When you want to allow operations only on roles created by a specific stack, you may specify a wildcard based on the stack name in the Resource of an IAM policy.
Here is an example that allows iam:PassRole.

{
  "Effect": "Allow",
  "Action": "iam:PassRole",
  "Resource": "arn:aws:iam::123456789012:role/prod-order-api-application-*"
}

A role whose stack name has been truncated does not match this Resource, so it is not covered by the permission.

prod-order-api-applicatio-OrderApiTaskExecutionRole-9w02y8Ta3WrL

Specifying the first 25 characters of the stack name followed by a wildcard matched all the combinations in this test.

arn:aws:iam::123456789012:role/prod-order-api-applicatio*

This specification also matches roles of other stacks whose first 25 characters are the same.

To fix the role name, specify RoleName.
A role with RoleName specified cannot be updated in a way that requires replacement.

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-properties-name.html

Summary

I checked how IAM role names automatically generated by CloudFormation are truncated.

• The stack name and logical ID used in the role name total at most 50 characters
• If both the stack name and the logical ID exceed 25 characters, the first 25 characters of each are used
• If you specify role/<stack name>-* in the Resource of an IAM policy, roles whose stack names have been truncated will not match, so either keep the stack name to 25 characters or fewer, or specify RoleName

I hope this article helps someone. Thank you for reading to the end!

References

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/resources-section-structure.html

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html

https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/TemplateReference/aws-properties-name.html