{"record":{"id":"28e27e8e83da7f91","repo":"serverless/serverless","slug":"invalid-config-28e27e","errorCode":"INVALID_CONFIG","errorMessage":"Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')","messagePattern":"Explicit service-wide IAM role \\(provider\\.role\\) cannot be combined with per-function IAM mode \\(provider\\.iam\\.role\\.mode: 'perFunction'\\)","errorType":"exception","errorClass":"ServerlessError","httpStatus":null,"severity":"error","filePath":"packages/serverless/lib/plugins/aws/package/lib/merge-iam-templates.js","lineNumber":43,"sourceCode":"          .Resources,\n        logGroupResources,\n      )\n    })\n\n    const iamConfig = this.serverless.service.provider.iam || {}\n    const iamRole = _.get(iamConfig, 'role', {})\n\n    // resolve early if provider level role is provided as a reference to existing role\n    if (this.provider.isExistingRoleProvided(iamRole)) {\n      return\n    }\n\n    const perFunctionIamRoleEnabled =\n      _.isObject(iamRole) && iamRole.mode === 'perFunction'\n\n    if ('role' in this.serverless.service.provider) {\n      if (perFunctionIamRoleEnabled) {\n        throw new ServerlessError(\n          \"Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')\",\n          ServerlessErrorCodes.general.INVALID_CONFIG,\n          {\n            stack: false,\n          },\n        )\n      }\n      return\n    }\n\n    // resolve early if all functions contain a custom role\n    const customRoleProvided = this.serverless.service\n      .getAllFunctions()\n      .every((functionName) => {\n        const functionObject = this.serverless.service.getFunction(functionName)\n        return 'role' in functionObject\n      })\n","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/serverless/serverless/blob/b9d7ea51c8cce57cff1207964b9b71123673081f/packages/serverless/lib/plugins/aws/package/lib/merge-iam-templates.js#L25-L61","documentation":"Error \"Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')\" thrown in serverless/serverless.","triggerScenarios":"Thrown at packages/serverless/lib/plugins/aws/package/lib/merge-iam-templates.js:43 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove provider.role, or change provider.iam.role.mode away from 'perFunction'; the two cannot be combined."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b9d7ea51c8cce57cff1207964b9b71123673081f","analyzedAt":"2026-08-13T04:14:40.386Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}