title: Error: The provided credentials do not have permission to create the service-linked role for EC2 Spot Instances
body: <p>I'm running into an error when creating a spot fleet request through cloudformation. The request is created but I'm getting the error mentioned in the title when the fleet attempts to request an instance.</p>
  <p>The permissions needed are described in <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-fleet-requests.html#spot-fleet-prerequisites" rel="noreferrer">here</a>, however when I try to follow the steps to create the <code>AWSServiceRoleForEC2SpotFleet</code> role I don't have the option to choose &quot;EC2 - Spot Fleet&quot;, only EC2 FLeet. What's odd is that when I create the CF stack it actually does create that service linked role for me.</p>
  <p>My user has admin credentials and I'm using the &quot;aws-ec2-spot-fleet-tagging-role&quot; as the fleet role.</p>
  <p>As I understand it the service linked role just needs to exist in order for this to work, but I'm unable to create it manually.
  I am able to successfully create the fleet via the console, using the exact same values as what I'm using in the template and I choose the same &quot;aws-ec2-spot-fleet-tagging-role&quot; there as well.</p>
  <p>I also gave my user the IAM credentials mentioned in that document, even though it's admin, just to see if I needed the pass through permission, but as I understand I only really need that if I'm supplying an instance profile in the launch specification, which I'm not. This is my resource definition in the template:</p>
  <pre class="lang-yaml prettyprint-override"><code>     SpotFleetRequestConfigData: 
          TargetCapacity: 1
          IamFleetRole:  arn:aws:iam::73682036499:role/aws-ec2-spot-fleet-tagging-role
          LaunchSpecifications: 
            - ImageId: '{{resolve:ssm:TestImage:4}}' #param stored reference to AMI
              InstanceType: t2.small
              NetworkInterfaces:
                - SubnetId: !ImportValue CustomVPCStack-dmz-subnet-1
                  DeviceIndex: 0
                  Groups:
                    - !Ref EC2MCServerSecurityGroup
              TagSpecifications:
                - 
                  ResourceType: instance
                  Tags: 
                    - 
                      Key: Name
                      Value: spotfleetserver
          ReplaceUnhealthyInstances: true
          Type: maintain #default```
  </code></pre>