# Policy creation works ... but does it?

**URL:** <https://forum.serverless.com/t/policy-creation-works-but-does-it/948>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [December 14, 2016, 9:39pm UTC](https://forum.serverless.com/t/policy-creation-works-but-does-it/948 "2016-12-14T21:39:39Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yankeeinlondon](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yankeeinlondon/32/244_2.png) [@yankeeinlondon](https://forum.serverless.com/u/yankeeinlondon)\
**Post date:** [December 14, 2016, 9:39pm UTC](https://forum.serverless.com/t/policy-creation-works-but-does-it/948/1 "2016-12-14T21:39:40Z")

</div>

I am intending to create a role per function in an serverless app that I’m creating but for now all functions are using the default role for the set of functions. In the mean time I’ve added as resources a number of **Policies** that I am assigning to this default role. Here’s an example of one of these policies:

```
logging:
  Type: AWS::IAM::Policy
  Properties:
    PolicyName: serverless-event-logging 
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Allow
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
          Resource: arn:aws:logs:${self:provider.region}:*:log-group:/aws/lambda/*:*:*
        - Effect: "Allow"
          Action:
            - "s3:PutObject"
          Resource:
            Fn::Join:
              - ""
              - - "arn:aws:s3:::"
                - "Ref" : "ServerlessDeploymentBucket" 
    Roles: 
      - serverless-event-${self:custom.stage}-${self:provider.region}-lambdaRole
      - serverless-event-${self:custom.stage}-receiver
      - serverless-event-${self:custom.stage}-reporter
      - serverless-event-${self:custom.stage}-aggregator

```

When I look at the role definition for the default role it indeed shows that it has the “serverless-event-logging” policy attached to it. Great. Here’s the problem, when I look at the other roles which I’ve created (aka, “receiver”, “reporter”, “aggregator”) these roles exist but the role has _not_ been assigned.

Furthermore, to my surprise, when I use AWS’s IAM console and look at the “Policies” tab none of the Policies I’ve created show up (that _might_ be ok, not sure, but it wasn’t what I was expecting).

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [December 14, 2016, 11:20pm UTC](https://forum.serverless.com/t/policy-creation-works-but-does-it/948/2 "2016-12-14T23:20:30Z")

</div>

It’s not obvious what’s going wrong here.

I think you need to run a `sls deploy --noDeploy` and look at the contents of the **update** CloudFormation template file in `.serverless/` and see where/if there are the references to the policies in the roles (or vice versa).

---

<div class="post-metadata">

**Author:** ![yankeeinlondon](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yankeeinlondon/32/244_2.png) [@yankeeinlondon](https://forum.serverless.com/u/yankeeinlondon)\
**Post date:** [December 15, 2016, 1:28am UTC](https://forum.serverless.com/t/policy-creation-works-but-does-it/948/3 "2016-12-15T01:28:03Z")

</div>

I’m a bit lost in the CloudFormation template but from my standpoint it appears that it’s ok too:

```auto
"logging": {
  "Type": "AWS::IAM::Policy",
  "Properties": {
    "PolicyName": "serverless-event-logging",
    "PolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "logs:CreateLogGroup",
            "logs:CreateLogStream",
            "logs:PutLogEvents"
          ],
          "Resource": "arn:aws:logs:eu-west-1:*:log-group:/aws/lambda/*:*:*"
        },
        {
          "Effect": "Allow",
          "Action": [
            "s3:PutObject"
          ],
          "Resource": {
            "Fn::Join": [
              "",
              [
                "arn:aws:s3:::",
                {
                  "Ref": "ServerlessDeploymentBucket"
                }
              ]
            ]
          }
        }
      ]
    },
    "Roles": [
      "serverless-event-dev-eu-west-1-lambdaRole",
      "serverless-event-dev-receiver",
      "serverless-event-dev-reporter",
      "serverless-event-dev-aggregator"
    ]
  }
},

```

---

<div class="post-metadata">

**Author:** ![yankeeinlondon](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/yankeeinlondon/32/244_2.png) [@yankeeinlondon](https://forum.serverless.com/u/yankeeinlondon)\
**Post date:** [December 15, 2016, 1:30am UTC](https://forum.serverless.com/t/policy-creation-works-but-does-it/948/4 "2016-12-15T01:30:08Z")

</div>

Well, i just checked again and for reasons unknown to me all the roles **ARE** now getting updated.