Every stack resource is created by an IAM principal: you, or a role you hand to CloudFormation 24 . Choosing well lets a team deploy its own stacks without administrator rights. LocalStack 4.13.1 63,725 stores these policies but enforces none, so here they are checked for shape only.