title: AWS Cloudformation Role is not authorized to perform AssumeRole on Role
body: <p>I am trying to execute a cloudformation stack which contains the following resources:</p>
  
  <ul>
  <li>Codebuild project</li>
  <li>Codepipeline pipeline</li>
  <li>Roles needed</li>
  </ul>
  
  <p>While trying to execute the stack, it fails with the following error: </p>
  
  <blockquote>
    <p>arn:aws:iam::ACCOUNT_ID:role/CodePipelineRole is not authorized to perform AssumeRole on role arn:aws:iam::ACCOUNT_ID:role/CodePipelineRole (Service: AWSCodePipeline; Status Code: 400; Error Code: InvalidStructureException; Request ID: 7de2b1c6-a432-47e6-8208-2c0072ebaf4b)</p>
  </blockquote>
  
  <p>I created the role using a managed policy, but I have already tried with a normal policy and it does not work neither.</p>
  
  <p>This is the Role Policy:</p>
  
  <pre><code>CodePipelinePolicy:
  Type: AWS::IAM::ManagedPolicy
  Properties:
    Description: 'This policy grants permissions to a service role to enable Codepipeline to use multiple AWS Resources on the users behalf'
    Path: "/"
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Resource: "*"
          Effect: "Allow"
          Condition: {}
          Action:
            - autoscaling:*
            - cloudwatch:*
            - cloudtrail:*
            - cloudformation:*
            - codebuild:*
            - codecommit:*
            - codedeploy:*
            - codepipeline:*
            - ec2:*
            - ecs:*
            - ecr:*
            - elasticbeanstalk:*
            - elasticloadbalancing:*
            - iam:*
            - lambda:*
            - logs:*
            - rds:*
            - s3:*
            - sns:*
            - ssm:*
            - sqs:*
            - kms:*
  </code></pre>
  
  <p>This is the Role </p>
  
  <pre><code>CodePipelineRole:
  Type: "AWS::IAM::Role"
  Properties:
    RoleName: !Sub ${EnvironmentName}-CodePipelineRole
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Action:
          - 'sts:AssumeRole'
          Effect: Allow
          Principal:
            Service:
            - codepipeline.amazonaws.com
    Path: /
    ManagedPolicyArns:
      - !Ref CodePipelinePolicy
  </code></pre>
  
  <p>What intrigues me the most is that it seems like CodePipelineRole is trying to AssumeRole to itself. I'm not understanding what can be happening here. </p>
  
  <p>And when I set the policy's action to *, it works! I don't know what permissions could be missing.</p>
  
  <p>Thanks </p>