Lambda Deployment Fails — IAM Role Name Already Exists

If a Lambda Component fails to deploy because an IAM role of that name already exists, this article explains why and how to fix it.

Symptoms

You deploy a new Lambda Component and the deployment fails with an error
stating that an IAM role with that name already exists. The error names a role
you did not create by hand.

This usually happens just after you have cloned an existing Lambda application
to make a new version or variant of it.

Cause

Lambda Components derive their IAM role name automatically from the
Component's instance name. When a new instance name is very similar to an
existing one, the derived role name can come out identical to the role that
already exists, and AWS rejects the second one.

Solution

1. Read the exact error and note the conflicting role name.
2. Rename your new Component instance to something clearly distinct from the
   existing one — not just a short suffix such as -v2 appended to a name
   that is already long.
3. Save and redeploy.

If you need to keep the short name you originally chose, raise a request. An
explicit role-name override may be possible.

Prevention

When cloning an existing Lambda application, give the copy a distinct instance
name up front rather than a near-identical one. Distinct early characters are
more reliable than a distinct ending.

Still having issues?

Raise a request and include the Component name, the environment, and the full
deployment error including the conflicting role name.

Related articles

• Troubleshooting Common Issues
• Components and Deployments
• Getting Help