# Conditionally create IAM role statement

**URL:** <https://forum.serverless.com/t/conditionally-create-iam-role-statement/11228>\
**Category:** Serverless Framework\
**Tags:** iam\
**Created:** [April 22, 2020, 11:36am UTC](https://forum.serverless.com/t/conditionally-create-iam-role-statement/11228 "2020-04-22T11:36:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![conrad](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@conrad](https://forum.serverless.com/u/conrad)\
**Post date:** [April 22, 2020, 11:36am UTC](https://forum.serverless.com/t/conditionally-create-iam-role-statement/11228/1 "2020-04-22T11:36:00Z")

</div>

For our application, we have a Kinesis stream that is only supposed to exist in one environment. Then we have an IAM role to allow Lambda to access the stream.

Since the stream will not exist in other environments, is it possible to conditionally create the Kinesis statement? Or should I just use some dummy value for the ARN?

I have tried specifying a `Condition` for the statement (with the definition under `resources.Conditions`) but this is returning a syntax error.

---

<div class="post-metadata">

**Author:** ![conrad](https://avatars.discourse-cdn.com/v4/letter/c/ebca7d/32.png) [@conrad](https://forum.serverless.com/u/conrad)\
**Post date:** [April 24, 2020, 12:34pm UTC](https://forum.serverless.com/t/conditionally-create-iam-role-statement/11228/2 "2020-04-24T12:34:40Z")

</div>

I managed to do this by moving the statement to a separate managed policy, and applying the Condition to that.

---

<div class="post-metadata">

**Author:** ![bfieber](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bfieber/32/653_2.png) [@bfieber](https://forum.serverless.com/u/bfieber)\
**Post date:** [June 22, 2020, 10:26pm UTC](https://forum.serverless.com/t/conditionally-create-iam-role-statement/11228/3 "2020-06-22T22:26:46Z")

</div>

In case you need another approach, here’s what I did.

```
resources:
  Conditions:
    IsEventSourceMappingEnabled:
      Fn::Or: # the event source will only exist in the stages defined here.
        - Fn::Equals: ["${self:provider.stage}", "dev2"]
        - Fn::Equals: ["${self:provider.stage}", "prod"]
  Resources:
    MyEventSourceMapping:
      DependsOn:
        - MyTable
      Type: AWS::Lambda::EventSourceMapping
      Condition: IsEventSourceMappingEnabled # reference the above condition to limit which stages the event source is created in
      Properties:
        BatchSize: 10
        EventSourceArn:
          Fn::GetAtt: [MyTable, StreamArn]
        FunctionName:
          Ref: MyHandlerLambdaFunction
        StartingPosition: TRIM_HORIZON
        Enabled: true

```

This would only create the EventSourceMapping in **prod** and **dev2** stages.