InsufficientCapabilitiesException [CAPABILITY_NAMED_IAM] when creating a stack with IAM policies

Question

I get this error when I run create-stack for a cloudformation template that contains IAM policies.

aws cloudformation create-stack --stack-name iam-stack --template-body file://./iam.yml --capabilities CAPABILITY_IAM --profile dev

An error occurred (InsufficientCapabilitiesException) when calling the CreateStack operation: Requires capabilities : [CAPABILITY_NAMED_IAM]

Answer 1

Change --capabilities to CAPABILITY_NAMED_IAM

If you have IAM resources with custom names, you must specify CAPABILITY_NAMED_IAM. If you don't specify this parameter, this action returns an InsufficientCapabilities error.

https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html

Answer 2

As per AWS docs, If you specify a Role name in cloud formation, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities Link

So your command should be

aws cloudformation create-stack --stack-name iam-stack --template-body file://./iam.yml --capabilities CAPABILITY_NAMED_IAM --profile dev

Answer 3

In my case I needed both CAPABILITY_IAM and CAPABILITY_NAMED_IAM capabilities for a resource of type "AWS::IAM::Role".

https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CloudFormation.html#createStack-property

Answer 4

If you are using AWS CodePipeline to deploy an EC2 using a CloudFormation stack, there is an option called "Capabilities" from which you can select CAPABILITY_NAMED_IAM.

Answer 5

You must pass capability as below if you're not letting CloudFormation name your IAM resources. Change from --capabilities CAPABILITY_IAM to --capabilities CAPABILITY_NAMED_IAM.