fix: ensure IAM Role name length does not exceed 64 characters (#4696)

aarongorka · npalm · Copilot · web-flow · commit afacbef8398d · 2025-09-09T15:13:27.000+02:00
When using a long enough `prefix`, the IAM Roles can exceed the maximum length allowed by AWS. For example: ``` │ Error: expected length of name to be in the range (1 - 64), got github-runners-prod-xxxxxxxxxxxxxx-prod-action-scale-down-lambda-role │ │ with module.multi_runner.module.runners["xxxxxxxxxxxxxx-prod"].aws_iam_role.scale_down, │ on .terraform/modules/multi_runner/modules/runners/scale-down.tf line 88, in resource "aws_iam_role" "scale_down": │ 88: name = "${var.prefix}-action-scale-down-lambda-role" ``` There is nowhere to override this, so your only options are to change the prefix for the entire module. This commit resolves this by truncating the name to fit under the maximum length. This primarily happens on the scale-up and scale-down Lambdas, but I've added it everywhere for consistency. Fixes: #3973 --------- Co-authored-by: Niek Palm <npalm@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Niek Palm <niek.palm@philips.com>
diff --git a/modules/ami-housekeeper/main.tf b/modules/ami-housekeeper/main.tf
@@ -55,7 +55,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {
 }
 
 resource "aws_iam_role" "ami_housekeeper" {
-  name                 = "${var.prefix}-ami-housekeeper-role"
+  name                 = "${substr("${var.prefix}-ami-housekeeper", 0, 54)}-${substr(md5("${var.prefix}-ami-housekeeper"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary
diff --git a/modules/lambda/main.tf b/modules/lambda/main.tf
@@ -60,7 +60,7 @@ resource "aws_cloudwatch_log_group" "main" {
 }
 
 resource "aws_iam_role" "main" {
-  name                 = "${var.lambda.prefix}-${var.lambda.name}"
+  name                 = "${substr("${var.lambda.prefix}-${var.lambda.name}", 0, 54)}-${substr(md5("${var.lambda.prefix}-${var.lambda.name}"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.lambda.role_permissions_boundary
diff --git a/modules/runner-binaries-syncer/runner-binaries-syncer.tf b/modules/runner-binaries-syncer/runner-binaries-syncer.tf
@@ -74,7 +74,7 @@ resource "aws_cloudwatch_log_group" "syncer" {
 }
 
 resource "aws_iam_role" "syncer_lambda" {
-  name                 = "${var.prefix}-action-syncer-lambda-role"
+  name                 = "${substr("${var.prefix}-syncer-lambda", 0, 54)}-${substr(md5("${var.prefix}-syncer-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary
diff --git a/modules/runners/policies-runner.tf b/modules/runners/policies-runner.tf
@@ -1,7 +1,7 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_iam_role" "runner" {
-  name                 = "${var.prefix}-runner-role"
+  name                 = "${substr("${var.prefix}-runner", 0, 54)}-${substr(md5("${var.prefix}-runner"), 0, 8)}"
   assume_role_policy   = templatefile("${path.module}/policies/instance-role-trust-policy.json", {})
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary
diff --git a/modules/runners/pool/main.tf b/modules/runners/pool/main.tf
@@ -74,7 +74,7 @@ resource "aws_cloudwatch_log_group" "pool" {
 }
 
 resource "aws_iam_role" "pool" {
-  name                 = "${var.config.prefix}-action-pool-lambda-role"
+  name                 = "${substr("${var.config.prefix}-pool-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-pool-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary
diff --git a/modules/runners/scale-down.tf b/modules/runners/scale-down.tf
@@ -85,7 +85,7 @@ resource "aws_lambda_permission" "scale_down" {
 }
 
 resource "aws_iam_role" "scale_down" {
-  name                 = "${var.prefix}-action-scale-down-lambda-role"
+  name                 = "${substr("${var.prefix}-scale-down-lambda", 0, 54)}-${substr(md5("${var.prefix}-scale-down-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary
diff --git a/modules/runners/scale-up.tf b/modules/runners/scale-up.tf
@@ -101,7 +101,7 @@ resource "aws_lambda_permission" "scale_runners_lambda" {
 }
 
 resource "aws_iam_role" "scale_up" {
-  name                 = "${var.prefix}-action-scale-up-lambda-role"
+  name                 = "${substr("${var.prefix}-scale-up-lambda", 0, 54)}-${substr(md5("${var.prefix}-scale-up-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
   permissions_boundary = var.role_permissions_boundary
diff --git a/modules/runners/ssm-housekeeper.tf b/modules/runners/ssm-housekeeper.tf
@@ -83,7 +83,7 @@ resource "aws_lambda_permission" "ssm_housekeeper" {
 }
 
 resource "aws_iam_role" "ssm_housekeeper" {
-  name                 = "${var.prefix}-ssm-hk-lambda"
+  name                 = "${substr("${var.prefix}-ssm-hk-lambda", 0, 54)}-${substr(md5("${var.prefix}-ssm-hk-lambda"), 0, 8)}"
   description          = "Lambda role for SSM Housekeeper (${var.prefix})"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = local.role_path
diff --git a/modules/setup-iam-permissions/main.tf b/modules/setup-iam-permissions/main.tf
@@ -1,7 +1,7 @@
 data "aws_caller_identity" "current" {}
 
 resource "aws_iam_role" "deploy" {
-  name = "${var.prefix}-terraform"
+  name = "${substr("${var.prefix}-terraform", 0, 54)}-${substr(md5("${var.prefix}-terraform"), 0, 8)}"
 
   permissions_boundary = aws_iam_policy.deploy_boundary.arn
   assume_role_policy = templatefile("${path.module}/policies/assume-role-for-account.json", {
diff --git a/modules/webhook/direct/webhook.tf b/modules/webhook/direct/webhook.tf
@@ -90,7 +90,7 @@ data "aws_iam_policy_document" "lambda_assume_role_policy" {
 }
 
 resource "aws_iam_role" "webhook_lambda" {
-  name                 = "${var.config.prefix}-direct-webhook-lambda-role"
+  name                 = "${substr("${var.config.prefix}-direct-webhook-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-direct-webhook-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary
diff --git a/modules/webhook/eventbridge/dispatcher.tf b/modules/webhook/eventbridge/dispatcher.tf
@@ -85,7 +85,7 @@ resource "aws_lambda_permission" "allow_cloudwatch_to_call_lambda" {
 }
 
 resource "aws_iam_role" "dispatcher_lambda" {
-  name                 = "${var.config.prefix}-dispatcher-lambda-role"
+  name                 = "${substr("${var.config.prefix}-dispatcher-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-dispatcher-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary
diff --git a/modules/webhook/eventbridge/webhook.tf b/modules/webhook/eventbridge/webhook.tf
@@ -89,7 +89,7 @@ data "aws_iam_policy_document" "lambda_assume_role_policy" {
 }
 
 resource "aws_iam_role" "webhook_lambda" {
-  name                 = "${var.config.prefix}-eventbridge-webhook-lambda-role"
+  name                 = "${substr("${var.config.prefix}-eventbridge-webhook-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-eventbridge-webhook-lambda"), 0, 8)}"
   assume_role_policy   = data.aws_iam_policy_document.lambda_assume_role_policy.json
   path                 = var.config.role_path
   permissions_boundary = var.config.role_permissions_boundary

Original file line number	Diff line number	Diff line change
`@@ -55,7 +55,7 @@ resource "aws_cloudwatch_log_group" "ami_housekeeper" {`
`55`	`55`	`}`
`56`	`56`
`57`	`57`	`resource "aws_iam_role" "ami_housekeeper" {`
`58`		`- name = "${var.prefix}-ami-housekeeper-role"`
	`58`	`+ name = "${substr("${var.prefix}-ami-housekeeper", 0, 54)}-${substr(md5("${var.prefix}-ami-housekeeper"), 0, 8)}"`
`59`	`59`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`60`	`60`	`path = local.role_path`
`61`	`61`	`permissions_boundary = var.role_permissions_boundary`
Original file line number	Diff line number	Diff line change
`@@ -60,7 +60,7 @@ resource "aws_cloudwatch_log_group" "main" {`
`60`	`60`	`}`
`61`	`61`
`62`	`62`	`resource "aws_iam_role" "main" {`
`63`		`- name = "${var.lambda.prefix}-${var.lambda.name}"`
	`63`	`+ name = "${substr("${var.lambda.prefix}-${var.lambda.name}", 0, 54)}-${substr(md5("${var.lambda.prefix}-${var.lambda.name}"), 0, 8)}"`
`64`	`64`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`65`	`65`	`path = local.role_path`
`66`	`66`	`permissions_boundary = var.lambda.role_permissions_boundary`
Original file line number	Diff line number	Diff line change
`@@ -74,7 +74,7 @@ resource "aws_cloudwatch_log_group" "syncer" {`
`74`	`74`	`}`
`75`	`75`
`76`	`76`	`resource "aws_iam_role" "syncer_lambda" {`
`77`		`- name = "${var.prefix}-action-syncer-lambda-role"`
	`77`	`+ name = "${substr("${var.prefix}-syncer-lambda", 0, 54)}-${substr(md5("${var.prefix}-syncer-lambda"), 0, 8)}"`
`78`	`78`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`79`	`79`	`path = local.role_path`
`80`	`80`	`permissions_boundary = var.role_permissions_boundary`
Original file line number	Diff line number	Diff line change
`@@ -85,7 +85,7 @@ resource "aws_lambda_permission" "scale_down" {`
`85`	`85`	`}`
`86`	`86`
`87`	`87`	`resource "aws_iam_role" "scale_down" {`
`88`		`- name = "${var.prefix}-action-scale-down-lambda-role"`
	`88`	`+ name = "${substr("${var.prefix}-scale-down-lambda", 0, 54)}-${substr(md5("${var.prefix}-scale-down-lambda"), 0, 8)}"`
`89`	`89`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`90`	`90`	`path = local.role_path`
`91`	`91`	`permissions_boundary = var.role_permissions_boundary`
Original file line number	Diff line number	Diff line change
`@@ -101,7 +101,7 @@ resource "aws_lambda_permission" "scale_runners_lambda" {`
`101`	`101`	`}`
`102`	`102`
`103`	`103`	`resource "aws_iam_role" "scale_up" {`
`104`		`- name = "${var.prefix}-action-scale-up-lambda-role"`
	`104`	`+ name = "${substr("${var.prefix}-scale-up-lambda", 0, 54)}-${substr(md5("${var.prefix}-scale-up-lambda"), 0, 8)}"`
`105`	`105`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`106`	`106`	`path = local.role_path`
`107`	`107`	`permissions_boundary = var.role_permissions_boundary`
Original file line number	Diff line number	Diff line change
`@@ -83,7 +83,7 @@ resource "aws_lambda_permission" "ssm_housekeeper" {`
`83`	`83`	`}`
`84`	`84`
`85`	`85`	`resource "aws_iam_role" "ssm_housekeeper" {`
`86`		`- name = "${var.prefix}-ssm-hk-lambda"`
	`86`	`+ name = "${substr("${var.prefix}-ssm-hk-lambda", 0, 54)}-${substr(md5("${var.prefix}-ssm-hk-lambda"), 0, 8)}"`
`87`	`87`	`description = "Lambda role for SSM Housekeeper (${var.prefix})"`
`88`	`88`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`89`	`89`	`path = local.role_path`
Original file line number	Diff line number	Diff line change
`@@ -90,7 +90,7 @@ data "aws_iam_policy_document" "lambda_assume_role_policy" {`
`90`	`90`	`}`
`91`	`91`
`92`	`92`	`resource "aws_iam_role" "webhook_lambda" {`
`93`		`- name = "${var.config.prefix}-direct-webhook-lambda-role"`
	`93`	`+ name = "${substr("${var.config.prefix}-direct-webhook-lambda", 0, 54)}-${substr(md5("${var.config.prefix}-direct-webhook-lambda"), 0, 8)}"`
`94`	`94`	`assume_role_policy = data.aws_iam_policy_document.lambda_assume_role_policy.json`
`95`	`95`	`path = var.config.role_path`
`96`	`96`	`permissions_boundary = var.config.role_permissions_boundary`