# Firehose Deployment Contradiction; RoleARN cannot be empty; Encountered unsupported Property RoleARN

**URL:** <https://forum.serverless.com/t/firehose-deployment-contradiction-rolearn-cannot-be-empty-encountered-unsupported-property-rolearn/4668>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [June 5, 2018, 12:18pm UTC](https://forum.serverless.com/t/firehose-deployment-contradiction-rolearn-cannot-be-empty-encountered-unsupported-property-rolearn/4668 "2018-06-05T12:18:31Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![bolster](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bolster/32/2019_2.png) [@bolster](https://forum.serverless.com/u/bolster)\
**Post date:** [June 5, 2018, 12:18pm UTC](https://forum.serverless.com/t/firehose-deployment-contradiction-rolearn-cannot-be-empty-encountered-unsupported-property-rolearn/4668/1 "2018-06-05T12:18:31Z")

</div>

Trying to create a Firehose Delivery Stream with this resource definition;

```auto
    SignatureFirehose:
          Type: AWS::KinesisFirehose::DeliveryStream
          Properties:
            DeliveryStreamName: ${self:service}-signature-firehose-${self:provider.stage}
            DeliveryStreamType: KinesisStreamAsSource
            KinesisStreamSourceConfiguration:
              KinesisStreamARN:
                Fn::GetAtt: [SignatureStream, Arn]
            S3DestinationConfiguration:
              BucketARN:
                Fn::GetAtt: [S3Store, Arn]
              BufferingHints:
                IntervalInSeconds: 300
                SizeInMBs: 5
              CompressionFormat: GZIP
              EncryptionConfiguration:
                KMSEncryptionConfig:
                  AWSKMSKeyARN: 'alias/aws/kinesis'
              Prefix: "fh/"
            RoleARN: # Note, nested directly under 'Properties'
              Fn::GetAtt: [FirehoseDelegateRole, Arn]

```

However, when I fire this up, I get `An error occurred: SignatureFirehose - Encountered unsupported property RoleARN`

So if i indent the RoleARN so that it’s a child of the S3 Config, I get this helpful little fella

`An error occurred: SignatureFirehose - Property RoleARN cannot be empty..`

What am I missing!?

For the record this is the FirehoseDelegateRole

```auto
    FirehoseDelegateRole:
      Type: AWS::IAM::Role
      Properties:
        RoleName: ${self:service}-fhdelegate
        AssumeRolePolicyDocument:
          Version: '2012-10-17'
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - firehose.amazonaws.com
              Action: sts:AssumeRole
        Policies:
          - PolicyName: ${self:service}-fhdelegate
            PolicyDocument:
              Version: '2012-10-17'
              Statement:
                - Effect: Allow
                  Action:
                    - s3:ListAllMyBuckets
                    - s3:GetBucketLocations
                  Resource: '*'
                - Effect: Allow
                  Action:
                    - s3:ListBucket
                  Resource:
                    - "arn:aws:s3:::*/**"
                - Effect: Allow
                  Action:
                    - s3:GetObject
                  Resource:
                    - "arn:aws:s3:::*/**"

```

---

<div class="post-metadata">

**Author:** ![bolster](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bolster/32/2019_2.png) [@bolster](https://forum.serverless.com/u/bolster)\
**Post date:** [June 5, 2018, 1:19pm UTC](https://forum.serverless.com/t/firehose-deployment-contradiction-rolearn-cannot-be-empty-encountered-unsupported-property-rolearn/4668/2 "2018-06-05T13:19:03Z")

</div>

So, turns out I was completely reading the error messages incorrectly and what was _actually_ happening was that _both_ the s3 destination config and the kinesis event stream config need their own access roles but the error messages don’t go any ‘deeper’ than the top level resource 🤦‍♂️