CloudFormation resources generated when AWS::Serverless::MicrovmImage is specified

When you specify an AWS::Serverless::MicrovmImage, AWS Serverless Application Model (AWS SAM) generates an AWS::Lambda::MicrovmImage base CloudFormation resource.

AWS::Lambda::MicrovmImage

LogicalId: <microvmimage‑LogicalId>

Referenceable property: N/A (you must use the LogicalId to reference this CloudFormation resource)

In addition to this CloudFormation resource, when AWS::Serverless::MicrovmImage is specified, AWS SAM also generates CloudFormation resources for the following scenarios:

BuildRoleArn property is not specified

When you don't specify the BuildRoleArn property of an AWS::Serverless::MicrovmImage, AWS SAM generates an AWS::IAM::Role CloudFormation resource with an inline policy granting the following permissions:

• s3:GetObject — scoped to the Amazon S3 bucket from CodeUri

• logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents — for build logs

The role trust policy allows the lambda.amazonaws.com service principal to assume the role.

AWS::IAM::Role

LogicalId: <microvmimage‑LogicalId>BuildRole