amazon-web-services - 如何调试cloudformation模板？策略中的语法错误。 YAML 文件

Question

部署堆栈时遇到的错误:

Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 

这是我的角色策略导致错误:

  roleEc2:
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Version: "2012-10-17"
    Statement:
      -
        Effect: Allow
        Principal:
          Service:
            - 'ec2.amazonaws.com'
        Action:
            - 'sts:AssumeRole'
  Path: '/'
  Policies:
    -
      PolicyName: 'bucket-access'
      PolicyDocument:
        Version: '2012-10-17'
        Id: 'BucketPolicy'
        Statement:
        - Effect: Allow
          Action:
          - s3:ListBucket
          - s3:GetObject
          - s3:GetBucketLocation
          Resource:
          - arn:aws:s3:::code-dir
          - arn:aws:s3:::code-dir/*
          Principal: !Ref BucketPrincipal

而且我不知道如何调试它，我不知道如何理解哪里有错误，什么行号。

Answer 1

(我知道这是一年后的事了，但仍然......)我喜欢使用的一个好工具是 cfn-lint:https://github.com/aws-cloudformation/cfn-python-lint针对您的模板运行此命令，它将显示您在哪一行做错了什么:

代码中的问题:没有前四行，在 IAM 策略中不能有委托(delegate)人(最后一行)。

---
AWSTemplateFormatVersion: '2010-09-09'
Description: AoD CloudFormation Template Detective Controls
Resources:
  roleEc2:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: Allow
            Principal:
              Service:
                - 'ec2.amazonaws.com'
            Action:
                - 'sts:AssumeRole'
      Path: '/'
      Policies:
        -
          PolicyName: 'bucket-access'
          PolicyDocument:
            Version: '2012-10-17'
            Id: 'BucketPolicy'
            Statement:
            - Effect: Allow
              Action:
              - s3:ListBucket
              - s3:GetObject
              - s3:GetBucketLocation
              Resource:
              - arn:aws:s3:::code-dir
              - arn:aws:s3:::code-dir/*