node.js - 调用CreateStack操作时发生错误(AccessDenied) :

Question

An error occurred (AccessDenied) when calling the CreateStack operation: User: arn:aws:iam::812520856627:user/dimitris is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-west-2:812520856627:stack/blog-stage/*

我试着在命令上运行它:

aws cloudformation create-stack --stack-name blog-stage --template-body file://$PWD/stack.yml --profile demo --region us-west-2

Resources:
  AppNode:
    Type: AWS::EC2::Instance
    Properties:
        InstanceType: t2.micro
        ImageId: ami-0c579621aaac8bade
        KeyName: jimapos
        SecurityGroups:
          - !Ref AppNodeSG
  AppNodeSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: for the app nodes that allow ssh, http and docker ports
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0
          - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0

Answer 1

您正在尝试针对未授权执行 cloudformation:CreateStack 的 User dimitris 创建堆栈

收件人assign permission给用户转到https://console.aws.amazon.com/iam/home#/home -> 用户 -> 选择用户 -> 添加权限

尝试添加此政策与用户 dimitries。

示例授予创建和查看堆栈操作的示例策略

{
    "Version":"2012-10-17",
    "Statement":[{
        "Effect":"Allow",
        "Action":[
            "cloudformation:CreateStack",
            "cloudformation:DescribeStacks",
            "cloudformation:DescribeStackEvents",
            "cloudformation:DescribeStackResources",
            "cloudformation:GetTemplate",
            "cloudformation:ValidateTemplate"  
        ],
        "Resource":"*"
    }]
}

你可以查看这个link为特定资源定制或重新制定政策。

您可以创建自定义策略，也可以附加下面现有的策略。