How CloudFormation's Auto-Generated Role Names Can Silently Break IAM Least-Privilege Policies

When AWS CloudFormation creates an IAM role without a specified RoleName, it generates a unique physical ID that may not match the naming pattern assumed in the stack's execution policy. This mismatch can cause deployment failures during forward operations and again during rollback, since the resource ARN pattern in the policy does not align with the actual generated role name. A common but flawed fix is to broaden the resource scope to cover all roles in the account, which eliminates the naming error but destroys the intended access boundary. Developers are advised to inspect the actual physical role name from stack events and update the policy to use the smallest verified prefix that covers only the intended role family. Least-privilege policies must account for the full role lifecycle — including tagging, policy attachment, and deletion — not just the initial creation step.