View a markdown version of this page

Amazon CloudFormation resources generated when AWS::Serverless::MicrovmImage is specified - Amazon Serverless Application Model
BuildRoleArn property is not specified
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon CloudFormation resources generated when AWS::Serverless::MicrovmImage is specified

When you specify an AWS::Serverless::MicrovmImage, Amazon Serverless Application Model (Amazon SAM) generates an AWS::Lambda::MicrovmImage base Amazon CloudFormation resource.

AWS::Lambda::MicrovmImage

LogicalId: <microvmimage‑LogicalId>

Referenceable property: N/A (you must use the LogicalId to reference this Amazon CloudFormation resource)

In addition to this Amazon CloudFormation resource, when AWS::Serverless::MicrovmImage is specified, Amazon SAM also generates Amazon CloudFormation resources for the following scenarios:

BuildRoleArn property is not specified

When you don't specify the BuildRoleArn property of an AWS::Serverless::MicrovmImage, Amazon SAM generates an AWS::IAM::Role Amazon CloudFormation resource with an inline policy granting the following permissions:

  • s3:GetObject — scoped to the Amazon S3 bucket from CodeUri

  • logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents — for build logs

The role trust policy allows the lambda.amazonaws.com service principal to assume the role.

AWS::IAM::Role

LogicalId: <microvmimage‑LogicalId>BuildRole