AWS Automation Document not updating Lambda Alias

Question

I've created an Automation Document using cloud formation to update the live alias for a given function. It runs ok without any errors and I'm not seeing anything cloud trail. But when I check which version is set to alias:live it is left unchanged.

template.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template for Response Plans"
Parameters:
  Environment:
    Type: String
    Default: "sandbox"
  Domain:
    Type: String
  Team:
    Type: String
  NotificationARN:
    Type: AWS::SSM::Parameter::Value<String>
Resources:
  ResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Actions:
        - SsmAutomation:
            RoleArn: !GetAtt Role.Arn
            DocumentName: UpdateAliasDocument
      DisplayName: "UpdateLambdaAlias"
      IncidentTemplate:
        Impact: 3
        NotificationTargets:
          - SnsTopicArn:
              Ref: NotificationARN
        Summary: "String"
        Title: "String"
      Name: "UpdateLambdaAlias"
      Tags:
        - Key: "Team"
          Value: !Ref Team
        - Key: "Domain"
          Value: !Ref Domain
        - Key: "Environment"
          Value: !Ref Environment
  Document:
    Type: AWS::SSM::Document
    Properties:
      Content:
        schemaVersion: "2.2"
        parameters:
          FunctionVersion:
            type: "String"
            default: "1"
          FunctionName:
            type: "String"
        mainSteps:
          - name: "UpdateLambdaAlias"
            action: aws:runShellScript
            inputs:
              runCommand:
                - aws lambda update-alias --function-name {{FunctionName}} --name live --function-version {{FunctionVersion}}
      DocumentType: "Command"
      TargetType: /
      Tags:
        - Key: "Team"
          Value: !Ref Team
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: EC2Instances
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - ec2:*
                Resource:
                  - !Sub arn:${AWS::Partition}:ec2:${AWS::Region}:${AWS::AccountId}:instance/*
        - PolicyName: UpdateAliasPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-*
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c2b8ca1dad447f8a
      InstanceType: t2.micro
      Monitoring: true
      Tags:
        - Key: "Team"
          Value: !Ref Team

Update

Looks like not target is being found to run the script on

Answer 1

It looks like your Role entry does not have the required permissions to execute the update-alias command. Your policy only allows for lambda:UpdateFunctionConfiguration.

You will at least need the lambda:UpdateAlias permission as well. If this is not enough, you could try being very permissive with your role and then reducing the permissions afterwards.