title: How to avoid giving `iam:CreateRole` permission when using existing S3 bucket to trigger Lambda function?
body: <p>I am trying to deploy an AWS Lambda function that gets triggered when an AVRO file is written to an existing S3 bucket.</p>
  
  <p>My <code>serverless.yml</code> configuration is as follows:</p>
  
  <pre class="lang-yaml prettyprint-override"><code>service: braze-lambdas
  
  provider:
    name: aws
    runtime: python3.7
    region: us-west-1
    role: arn:aws:iam::&lt;account_id&gt;:role/&lt;role_name&gt;
    stage: dev
    deploymentBucket:
      name: serverless-framework-dev-us-west-1
      serverSideEncryption: AES256
  
  functions:
    hello:
      handler: handler.hello
      events:
        - s3:
            bucket: &lt;company&gt;-dev-ec2-us-west-2
            existing: true
            events: s3:ObjectCreated:*
            rules:
              - prefix: gaurav/lambdas/123/
              - suffix: .avro
  </code></pre>
  
  <p>When I run <code>serverless deploy</code>, I get the following error:</p>
  
  <pre><code>ServerlessError: An error occurred: IamRoleCustomResourcesLambdaExecution - API: iam:CreateRole User: arn:aws:sts::&lt;account_id&gt;:assumed-role/serverless-framework-dev/jenkins_braze_lambdas_deploy is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::&lt;account_id&gt;:role/braze-lambdas-dev-IamRoleCustomResourcesLambdaExec-1M5QQI6P2ZYUH. 
  </code></pre>
  
  <p>I see some mentions of Serverless needing <code>iam:CreateRole</code> because of how CloudFormation works but can anyone confirm if that is the only solution if I want to use <code>existing: true</code>? Is there another way around it except using the old Serverless plugin that was used prior to the framework adding support for the <code>existing: true</code> configuration?</p>
  
  <p>Also, what is <code>1M5QQI6P2ZYUH</code> in <code>arn:aws:iam::&lt;account_id&gt;:role/braze-lambdas-dev-IamRoleCustomResourcesLambdaExec-1M5QQI6P2ZYUH</code>? Is it a random identifier? Does this mean that Serverless will try to create a new IAM role every time I try to deploy the Lambda function?</p>