# Using different IAM roles depending on stage

**URL:** <https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919>\
**Category:** Serverless Framework\
**Tags:** aws\
**Created:** [December 10, 2016, 5:40pm UTC](https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919 "2016-12-10T17:40:33Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![endymion](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/endymion/32/178_2.png) [@endymion](https://forum.serverless.com/u/endymion)\
**Post date:** [December 10, 2016, 5:40pm UTC](https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919/1 "2016-12-10T17:40:33Z")

</div>

Hi,  
My serverless deployments use this statement for configuring the IAM Role permissions:

iamRoleStatements:  
$ref: ./iamRoleStatements.json

The json file contains these permissions:

```
[
  {
    "Effect": "Allow",
    "Action": [
      "dynamodb:BatchGetItem",
      "dynamodb:BatchWriteItem",
      "dynamodb:DeleteItem",
      "dynamodb:GetItem",
      "dynamodb:GetRecords",
      "dynamodb:GetShardIterator",
      "dynamodb:PutItem",
      "dynamodb:Query",
      "dynamodb:Scan",
      "dynamodb:UpdateItem"
    ],
    "Resource": "arn:aws:dynamodb:*:222222222222:*"
  },
  {
    "Effect": "Allow",
    "Action": [
        "cognito-identity:GetOpenIdTokenForDeveloperIdentity",
        "cognito-identity:LookupDeveloperIdentity",
        "cognito-identity:MergeDeveloperIdentities",
        "cognito-identity:UnlinkDeveloperIdentity"
      ],
      "Resource": "arn:aws:cognito-identity:eu-central-1:222222222222:*"
  },
  {
    "Effect": "Allow",
    "Action": [
        "ec2:CreateNetworkInterface",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DeleteNetworkInterface"
    ],
    "Resource": "*"
  }
]

```

Currently we are using eu-central-1 as development environment but we will use another zone for production.

Basically I need to configure the cognito resource like this:  
dev stage: “Resource”: “arn:aws:cognito-identity: **eu-central-1** :222222222222:_"  
prod stage: “Resource”: "arn:aws:cognito-identity: **eu-west-1** :222222222222:_”

**How can I achieve this?**

Thank you in advance

---

<div class="post-metadata">

**Author:** ![rowanu](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/rowanu/32/75_2.png) [@rowanu](https://forum.serverless.com/u/rowanu)\
**Post date:** [December 11, 2016, 7:05pm UTC](https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919/2 "2016-12-11T19:05:54Z")

</div>

You could make the Resource (or just the region part of it) a variable. I can’t recall off the top of my head if you can put Serverless Variables in an external file that you load - you can definitely do it by moving your policy in to your `serverless.yml` and doing something like `${env:${opt:stage}_resource}`.

---

<div class="post-metadata">

**Author:** ![buggy](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/buggy/32/177_2.png) [@buggy](https://forum.serverless.com/u/buggy)\
**Post date:** [December 12, 2016, 12:23am UTC](https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919/3 "2016-12-12T00:23:35Z")

</div>

You can use Serverless variable inside external files (the YAML files at least). I’ve done it using external YAML files to define environment variables. I’d convert it to a YAML file then use `${self:provider.region}` inside your definition.

This is un-tested but should work.

`"Resource": "arn:aws:cognito-identity:${self:provider.region}:222222222222:*"`

---

<div class="post-metadata">

**Author:** ![tobyhede](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.serverless.com/tobyhede/32/283_2.png) [@tobyhede](https://forum.serverless.com/u/tobyhede)\
**Post date:** [December 12, 2016, 11:10pm UTC](https://forum.serverless.com/t/using-different-iam-roles-depending-on-stage/919/4 "2016-12-12T23:10:07Z")

</div>

Same solution here. Variables interpolated into the resource names.