# Generated policy is missing certain IAM permissions

**URL:** <https://forum.serverless.com/t/generated-policy-is-missing-certain-iam-permissions/3073>\
**Category:** Serverless Framework\
**Created:** [November 10, 2017, 3:33pm UTC](https://forum.serverless.com/t/generated-policy-is-missing-certain-iam-permissions/3073 "2017-11-10T15:33:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jacobrharris](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@jacobrharris](https://forum.serverless.com/u/jacobrharris)\
**Post date:** [November 10, 2017, 3:33pm UTC](https://forum.serverless.com/t/generated-policy-is-missing-certain-iam-permissions/3073/1 "2017-11-10T15:33:31Z")

</div>

In my `serverless.yml` file, I’ve got IAM statements that look like this:

```
iamRoleStatements:
   - Effect: Allow
     Action:
       - s3:ListBucket
       - dynamodb:DescribeStream
       - dynamodb:GetRecords
       - dynamodb:GetShardIterator
       - dynamodb:ListStreams
       - dynamodb:GetItem
       - dynamodb:PutItem
       - dynamodb:BatchWriteItem
       - dynamodb:Scan
       - logs:CreateLogGroup
       - logs:CreateLogStream
       - logs:PutLogEvents
     Resource: "*"

```

But I’m not seeing all of these reflected in the generated policy. Specifically, it seems to be missing:

```
    s3:ListBucket
    dynamodb:GetItem
    dynamodb:PutItem
    dynamodb:BatchWriteItem
    dynamodb:Scan

```

I suspect that I’m getting some sort of default policy instead of the custom one I’m trying to make inside `serverless.yml`. Am I doing this wrong?

---

<div class="post-metadata">

**Author:** ![bill](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/bill/32/1072_2.png) [@bill](https://forum.serverless.com/u/bill)\
**Post date:** [November 12, 2017, 1:18am UTC](https://forum.serverless.com/t/generated-policy-is-missing-certain-iam-permissions/3073/2 "2017-11-12T01:18:18Z")

</div>

What IAM role did you check?

Did you wait for a while and check again? The role policy is not updated immediately, sometime you have to wait for several minutes.

---

<div class="post-metadata">

**Author:** ![jacobrharris](https://avatars.discourse-cdn.com/v4/letter/j/ec9cab/32.png) [@jacobrharris](https://forum.serverless.com/u/jacobrharris)\
**Post date:** [November 12, 2017, 1:50pm UTC](https://forum.serverless.com/t/generated-policy-is-missing-certain-iam-permissions/3073/3 "2017-11-12T13:50:13Z")

</div>

I actually worked around this issue by adding a role manually in the AWS console and then linking to it in the `provider` section of `serverless.yml`.