Add plugin option: skipCreateDefaultRole about serverless-iam-roles-per-function HOT 12 OPEN

This is actually an important feature, I have just run into a problem where the default role is getting a policy that is longer than what IAM supports and it is causing my deploy to fail even though this role serves no purpose in existing.

from serverless-iam-roles-per-function.

Just in case anyone needs to prevent the default role (IamRoleLambdaExecution) to be created by the serverless framework, I created this plugin which does exactly that.

When you run "sls deploy", before deploying the stack it will remove that role.

from serverless-iam-roles-per-function.

A workaround for this is to rename the default role to something shorter.

resources:
  Resources:
    IamRoleLambdaExecution:
      Properties:
        RoleName: "my-short-role-name"

The RoleName gets merged into the IamRoleLambdaExecution resource.

from serverless-iam-roles-per-function.

Is plugin creates a default role on top of provider.iamRoleStatements? Because I have the same issue during the deploy - IamRoleLambdaExecution - <name>-dev-<region>-lambdaRole already exists, but I want to keep provider.iamRoleStatements. I am also using defaultInherit: true.
Thanks

from serverless-iam-roles-per-function.

I'm having the exact same issue as @Gerharddc :/

from serverless-iam-roles-per-function.

I'm having the exact same issue as @Gerharddc

from serverless-iam-roles-per-function.

Just an FYI, the fact that the default role still gets created is problematic for us. We do not care about the fact it is created, but the naming convention will cause namespace collisions. For our use case, we use an additional custom command line parameter to control naming (eg "--myParameter bill" to set myParameter to bill, which then adds bill to resource names).

from serverless-iam-roles-per-function.

This would be an amazing feature to have, running into the same issue as @Gerharddc

from serverless-iam-roles-per-function.

Agree, this would be a great option to have as had same issue as @Gerharddc

Using custom role was not option as this plugin then does not work as it requires the default role (IamRoleLambdaExecution) to be there as it then builds on that for each function.

A work-around that might help and I am sure others can make this better, but you can create a basic plugin to adjust the template contents before it is deployed. Example below:

1. Create sub folder .serverless_plugins in your project folder (same one as where your serverless.yml will be) and create a script in this sub folder - example - reset-role-plugin.js

Example reset-role-plugin.js (note the file name will be the name of plugin in serverless.yml)

'use strict'

class ResetDefaultExecutionRole {
  constructor (serverless, options) {
    this.hooks = {
      'before:package:finalize': function () { resetDefaultExecRole(serverless) }
    }
  }
}


function resetDefaultExecRole (serverless) {
  let resourceSection = serverless.service.provider.compiledCloudFormationTemplate.Resources

  // build new policyStatement, customize this to requirements, example only 
  const policyStatements = [];
  policyStatements[0] = {
    Effect: 'Allow',
    Action: ['logs:CreateLogStream', 'logs:CreateLogGroup', 'logs:PutLogEvents'],
    Resource: [
            {
              'Fn::Sub': 'arn:${AWS::Partition}:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:*:*'
            },
        ],
    };

  for (let key in resourceSection) {
    if (key === 'IamRoleLambdaExecution') {
      // update the IamRoleLambdaExecution role policy statements
      resourceSection[key].Properties.Policies[0].PolicyDocument.Statement = policyStatements
    }
  }
}

module.exports = ResetDefaultExecutionRole

2. Add to your serverless.yml file:

...
...
plugins:
  - serverless-iam-roles-per-function
  - reset-role-plugin
...
...

3. Test your CloudFormation template by running "sls package ......" which just creates the files in .serverless folder and you can then review the CloudFormation template there and look at the IamRoleLambdaExecution role.

from serverless-iam-roles-per-function.

For anybody interested in reducing the default IAM role size - check out https://github.com/shelfio/serverless-simplify-default-exec-role-plugin (kudos to @aelsnz)

from serverless-iam-roles-per-function.

Any update on this? We would really love this!

from serverless-iam-roles-per-function.

We have the same issue as Gerharddc.
It would be awesome to not use an extra plugin to delete the default role.

from serverless-iam-roles-per-function.