Stack deploy error: Policy arn:aws:iam::aws:policy/service-role/AWSConfigRole does not exist or is not attachable

[phitoduck]

Hi there, I went to deploy this stack today and got the following error:

(thrown when creating the ConfigRole resource)

Policy arn:aws:iam::aws:policy/service-role/AWSConfigRole does not exist or is not attachable. (Service: AmazonIdentityManagement; Status Code: 404; Error Code: NoSuchEntity; Request ID: 7a7836dd-0c87-4dca-85cb-6e94da045748; Proxy: null)

This probably caused the second error:

(thrown when creating the DeliveryChannel resource)

Configuration recorder is not available to put delivery channel. (Service: AmazonConfig; Status Code: 400; Error Code: NoAvailableConfigurationRecorderException; Request ID: 0c9fa708-2bc4-43bf-a0e5-9f64290c1004; Proxy: null)

I confirmed that the ConfigRole resource is indeed trying to access

Resources:
  # ...
  ConfigRole:
    Type: AWS::IAM::Role
    Condition: ShouldCreateConfig
    Properties: 
      AssumeRolePolicyDocument: 
        Version: 2012-10-17
        Statement: 
          - Effect: Allow
            Principal:
              Service:
              - config.amazonaws.com 
            Action: 
              - 'sts:AssumeRole'
      Path: /service-role/
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/service-role/AWSConfigRole
      Policies:
        - PolicyName: ConfigService-S3Access
          PolicyDocument: 
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action: 
                  - 's3:PutObject'
                  - 's3:PutObjectAcl'
                Resource: !Join ['', ['arn:aws:s3:::', !Ref ConfigS3Bucket, '/AWSLogs/', !Ref AWS::AccountId, '/*']]
      Description: Role to allow Config Service communicate with Delivery Channel
      RoleName: !Join ['-', ['ConfigRole', !Select [0, !Split ['-', !Select [2, !Split ['/', !Ref 'AWS::StackId' ]]]]]]

I noticed that the managed policy referenced in the policy does not exist in our AWS account. Could it be because our account is part of an AWS Organization?

As a workaround, I'll copy the YAML for this stack directly into the CDK app we use to deploy, and simply change the policy name to the AWS Organizations version.