# Error deploying serverless : An error occurred: IamRoleLambdaExecution - Actions/Conditions must be prefaced by a vendor

**URL:** <https://forum.serverless.com/t/error-deploying-serverless-an-error-occurred-iamrolelambdaexecution-actions-conditions-must-be-prefaced-by-a-vendor/9380>\
**Category:** Serverless Framework\
**Created:** [September 18, 2019, 5:07pm UTC](https://forum.serverless.com/t/error-deploying-serverless-an-error-occurred-iamrolelambdaexecution-actions-conditions-must-be-prefaced-by-a-vendor/9380 "2019-09-18T17:07:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![subhadlearner](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@subhadlearner](https://forum.serverless.com/u/subhadlearner)\
**Post date:** [September 18, 2019, 5:07pm UTC](https://forum.serverless.com/t/error-deploying-serverless-an-error-occurred-iamrolelambdaexecution-actions-conditions-must-be-prefaced-by-a-vendor/9380/1 "2019-09-18T17:07:16Z")

</div>

I am using Serverless version 1.52, node version 10.16.

I am getting the below error while deploying the serverless app.

An error occurred: IamRoleLambdaExecution - Actions/Conditions must be prefaced by a vendor, e.g., iam, sdb, ec2, etc. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 811c02ba-da31-11e9-812d-d97d855c6c5b).

Not sure from where it is coming. In cloudformation console also it is showing the same error. Please help.

I am using sls deploy command to deploy the app.

Below is my serverless.yaml file. Please help.

> ```
> service: sls-notes-backend
> 
> plugins:
> - serverless-offline
> 
> custom:
> allowedHeaders:
> - Accept
> - Content-Type
> - Content-Length
> - app_user_id
> - app_user_name
> - Authorization
> 
> provider:
> name: aws
> runtime: nodejs10.x
> region: us-east-1
> stage: dev
> timeout: 6
> memorySize: 128
> endpointType: regional
>   
> environment:
> NOTES_TABLE: ${self:service}-${opt.stage,self:provider.stage}
> iamRoleStatements:
> - Effect: Allow
> Action:
> - dynamodb.Query
> - dynamodb.PutItem
> - dynamodb.DeleteItem
> Resource: "arn:aws:dynamodb:${opt:region,self:provider.region}:*:table/${self:provider.environment.NOTES_TABLE}"
> functions:
> add-note:
> handler: api/add-note.handler
> description: POST /note
> events:
> - http:
> path: note
> method: post
> cors:
> origin: '*'
> headers: ${self:custom.allowedHeaders}
> update-note:
> handler: api/update-note.handler
> description: PATCH /note
> events:
> - http:
> path: note
> method: patch
> cors:
> origin: '*'
> headers: ${self:custom.allowedHeaders}
> get-notes:
> handler: api/get-notes.handler
> description: GET /notes
> events:
> - http:
> path: notes
> method: get
> cors:
> origin: '*'
> headers: ${self:custom.allowedHeaders}
> get-note:
> handler: api/get-note.handler
> description: GET /note/n/{note_id}
> events:
> - http:
> path: note/n/{note_id}
> method: get
> cors:
> origin: '*'
> headers: ${self:custom.allowedHeaders}
> delete-note:
> handler: api/delete-note.handler
> description: DELETE /note/t/{timestamp}
> events:
> - http:
> path: note/t/{timestamp}
> method: delete
> cors:
> origin: '*'
> headers: ${self:custom.allowedHeaders}
> 
> resources:
> Resources:
> NotesTable:
> Type: AWS::DynamoDB::Table
> DeletionPolicy: Retain
> Properties:
> TableName: ${self:provider.environment.NOTES_TABLE}
> AttributeDefinitions:
> - AttributeName: user_id
> AttributeType: S
> - AttributeName: timestamp
> AttributeType: N
> - AttributeName: note_id
> AttributeType: S
> KeySchema:
> - AttributeName: user_id
> KeyType: HASH
> - AttributeName: timestamp
> KeyType: RANGE
> ProvisionedThroughput:
> ReadCapacityUnits: 1
> WriteCapacityUnits: 1
> GlobalSecondaryIndexes:
> - IndexName: note_id-index
> KeySchema:
> - AttributeName: note_id
> KeyType: HASH
> Projection:
> ProjectionType: ALL
> ProvisionedThroughput:
> ReadCapacityUnits: 1
> WriteCapacityUnits: 1
> 
> ```

---

<div class="post-metadata">

**Author:** ![marcd123](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/marcd123/32/6240_2.png) [@marcd123](https://forum.serverless.com/u/marcd123)\
**Post date:** [October 3, 2021, 6:54pm UTC](https://forum.serverless.com/t/error-deploying-serverless-an-error-occurred-iamrolelambdaexecution-actions-conditions-must-be-prefaced-by-a-vendor/9380/2 "2021-10-03T18:54:54Z")

</div>

I’m guessing OP has figured this out since 2019, but for anyone facing this issue…

The Action specification uses colons (🙂 and not period (.) to separate the service name and the specific action. The OP had this code:

```auto
Action:
        - dynamodb.Query
        - dynamodb.PutItem
        - dynamodb.DeleteItem

```

And that should have been this:

```auto
Action:
        - dynamodb:Query
        - dynamodb:PutItem
        - dynamodb:DeleteItem

```