Overview

"CloudFix templates" and the template-approval step were part of AWS Change Manager, which CloudFix has fully retired — every tenant now executes fixers through Direct SSM Automation, and there is no template or template-approval action to configure any more. This article previously described a template-approval failure caused by CloudFix being unable to create an IAM group in the target account. That specific cause no longer applies: CloudFix's onboarding stack no longer creates IAM users or groups at all, only IAM roles.

Solution

If a customer's onboarding stack fails to create because of governance restrictions on creating IAM identities (typically IAM roles such as cloudfix-fixer-approver-role) in the target account, that is a stack-installation issue, not a template-approval issue. Refer to the solution steps in the CloudFix cannot Create IAM Users and Groups article to fix this issue.