[Question] CodeStarWorker-test-CloudFormation/AWSCloudFormation is not authorized to perform: iam:CreateRole on resource:

[Jun711]

Description:
One of my 'AWS::Serverless::Function' has a policies property like following (without a role property)

Type: 'AWS::Serverless::Function'
    Properties:
      Handler: helloWorld.handler
      Runtime: python3.6
      MemorySize: 128
      Description: 'helloWorld'
      FunctionName: helloWorld
      Policies:
        - Statement:
            - Effect: "Allow"
              Action: 
                - "polly:SynthesizeSpeech"
              Resource:
                - "Fn::Sub": "arn:aws:polly:${AWS::Region}:${AWS::AccountId}:lexicon/*"

Observed result:
CodePipeline ExecuteChangeSet failed with this error:
API: iam:CreateRole User: arn:aws:sts::AccountId:assumed-role/CodeStarWorker-test-CloudFormation/AWSCloudFormation is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::AccountId:role/awscodestar-test-lambda-helloWorldRole-V5QUHYDCDRBA

So, I went on to add iam:CreateRole policy to the AWSCloudFormation role and I retried.
In IAM Policy Simulator, that AWSCloudFormation role was able to perform IAM CreateRole action.
However, I got the same error.

Expected result:
Expected a new role to be created with the Polly policy.

[Jun711]

I found out that I had to add a list of iam policies to my CodeStar CloudFormation role to enable the creation of role by CloudFormation using SAM function policies property in the yaml template.

[Trav-Uncommitted]

Hi @Jun711
I'm having this same issue and I'm not sure how you resolved it. Can you provide some more details?

Is there something I need to add to the CodeDeployRole?

CodeDeployRole:
Type: String
Description: IAM role to allow AWS CodeDeploy to manage deployment of AWS Lambda functions

[Jun711]

@Trav-Uncommitted
sorry for late reply. I didn't have to add anything to CodeDeployRole. I just added some iam policies to the CloudFormation role to allow it to create roles. You can check out this article for more information.