Problem: "AWSCloudFormationStackSetExecutionRole already exists" error

When creating AWS CloudFormation StackSets using Landing Zone Accelerator on AWS, the solution attempts to create IAM roles required for deploying StackSets with self-managed permissions. Specifically, the two required roles are:

• AWSCloudFormationStackSetAdministrationRole - This role is deployed to the Management account.

• AWSCloudFormationStackSetExecutionRole - This role is deployed to all accounts.

When deploying Landing Zone Accelerator on AWS to an environment where these roles already exist, the pipeline will fail with the AWSCloudFormationStackSetAdministrationRole already exists or AWSCloudFormationStackSetExecutionRole already exists error.

Resolution

1. Delete the AWSCloudFormationStackSetAdministrationRole IAM role from the Management account.

2. Delete the AWSCloudFormationStackSetExecutionRole IAM role from all accounts.

3. Retry the failed pipeline stage.