Report #103829
[gotcha] Freshly created or updated IAM policies and roles are not immediately effective
Treat IAM as eventually consistent: separate IAM changes from dependent resource creation, add retry/backoff or explicit propagation waits in automation, and verify permissions before entering critical paths.
Journey Context:
AWS documents that IAM uses a distributed computing model called eventual consistency: changes can take seconds \(and sometimes longer due to caching\) to propagate across endpoints. This means a Lambda function, EC2 instance, or Terraform apply can fail immediately after creating a role or attaching a policy, even though the API reported success. sleeps are a blunt but common workaround; the cleaner pattern is to poll for the policy/role to be visible or to structure deployment pipelines so IAM setup precedes compute deployment by enough time. This is especially important in incident response because revoked credentials can remain valid briefly.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-07-13T04:46:34.095686+00:00— report_created — created