serverless/serverless · error · ServerlessError

INVALID_CONFIG

INVALID_CONFIG

Error message

Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')

What it means

Error "Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')" thrown in serverless/serverless.

Source

Thrown at packages/serverless/lib/plugins/aws/package/lib/merge-iam-templates.js:43

          .Resources,
        logGroupResources,
      )
    })

    const iamConfig = this.serverless.service.provider.iam || {}
    const iamRole = _.get(iamConfig, 'role', {})

    // resolve early if provider level role is provided as a reference to existing role
    if (this.provider.isExistingRoleProvided(iamRole)) {
      return
    }

    const perFunctionIamRoleEnabled =
      _.isObject(iamRole) && iamRole.mode === 'perFunction'

    if ('role' in this.serverless.service.provider) {
      if (perFunctionIamRoleEnabled) {
        throw new ServerlessError(
          "Explicit service-wide IAM role (provider.role) cannot be combined with per-function IAM mode (provider.iam.role.mode: 'perFunction')",
          ServerlessErrorCodes.general.INVALID_CONFIG,
          {
            stack: false,
          },
        )
      }
      return
    }

    // resolve early if all functions contain a custom role
    const customRoleProvided = this.serverless.service
      .getAllFunctions()
      .every((functionName) => {
        const functionObject = this.serverless.service.getFunction(functionName)
        return 'role' in functionObject
      })

View on GitHub (pinned to b9d7ea51c8)

Solutions

1. Remove provider.role, or change provider.iam.role.mode away from 'perFunction'; the two cannot be combined.

When it happens

Trigger: Thrown at packages/serverless/lib/plugins/aws/package/lib/merge-iam-templates.js:43 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of serverless/serverless@b9d7ea51c8 (2026-08-13). Data as JSON: /api/errors/28e27e8e83da7f91. Report an issue: GitHub.