IAM execution-role name can exceed 64-char limit (CreateRole ValidationError)

[cnuss]

Summary

When deploying to AWS Lambda, rowdy derives the execution-role name from the name: input but does not enforce IAM's 64-character role-name limit. With a longer name the CreateRole/UpdateRole calls fail with a ValidationError and the deploy dies.

Repro

GitHub Actions step:

- uses: scaffoldly/rowdy@github
  with:
    cloud: aws
    compute: lambda
    name: ${{ github.repository }}   # e.g. OWASP-CTF/dc34-owasp-secure-development-ctf
    image: ghcr.io/owasp-ctf/score:latest

Observed

rowdy generates role name:

owasp-ctf+score@OWASP-CTF.dc34-owasp-secure-development-ctf.rowdy.run   (69 chars)

and IAM rejects it:

[IAMClient] [CreateRoleCommand] ...
_IAMServiceException [ValidationError]: 1 validation error detected:
Value at 'roleName' failed to satisfy constraint:
Member must have length less than or equal to 64
$metadata: { httpStatusCode: 400 }, Code: 'ValidationError'

Same failure on the UpdateRoleCommand rowdy tries first.

Workaround

Omitting name: lets rowdy auto-generate a short name (owasp-ctf+score@rowdy.run), which fits. So the issue is specifically the unbounded name derived from a user-supplied name.

Suggested fix

When constructing the role name, enforce the 64-char cap — e.g. truncate the derived portion and append a short deterministic hash so names stay unique and valid (similar to how other tools handle the IAM 64-char limit). Failing fast with a clear error when name is too long would also be an improvement over the raw AWS ValidationError.

Environment

• scaffoldly/rowdy@github, run on ubuntu-latest, Node 24
• AWS region us-east-1, compute: lambda