amazon-web-services - AWS CodeDeploy : Service role Cannot assume role provided

Question

我正在尝试使用我的 GitHub 设置 CodeDeploy，但发现了一些问题。

我已使用 AWSCodeDeployRole 策略创建了服务角色，如文档中所述。

在我的 Code Deploy 应用程序创建过程中，我遇到了一个问题:

Cannot assume role provided.

正如我所看到的，我的 AWSCodeDeployRole 角色拥有很多自动扩展权限，但这对我来说并不是预期的:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "autoscaling:CompleteLifecycleAction",
        "autoscaling:DeleteLifecycleHook",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribeLifecycleHooks",
        "autoscaling:PutLifecycleHook",
        "autoscaling:RecordLifecycleActionHeartbeat",
        "autoscaling:CreateAutoScalingGroup",
        "autoscaling:UpdateAutoScalingGroup",
        "autoscaling:EnableMetricsCollection",
        "autoscaling:DescribeAutoScalingGroups",
        "autoscaling:DescribePolicies",
        "autoscaling:DescribeScheduledActions",
        "autoscaling:DescribeNotificationConfigurations",
        "autoscaling:DescribeLifecycleHooks",
        "autoscaling:SuspendProcesses",
        "autoscaling:ResumeProcesses",
        "autoscaling:AttachLoadBalancers",
        "autoscaling:PutScalingPolicy",
        "autoscaling:PutScheduledUpdateGroupAction",
        "autoscaling:PutNotificationConfiguration",
        "autoscaling:PutLifecycleHook",
        "autoscaling:DescribeScalingActivities",
        "autoscaling:DeleteAutoScalingGroup",
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceStatus",
        "ec2:TerminateInstances",
        "tag:GetTags",
        "tag:GetResources",
        "sns:Publish",
        "cloudwatch:DescribeAlarms",
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeInstanceHealth",
        "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
        "elasticloadbalancing:DeregisterInstancesFromLoadBalancer"
      ],
      "Resource": "*"
    }
  ]
}

在一些谷歌搜索过程中，我发现 CodeDeploy 应用程序可能需要类似以下内容:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "codedeploy.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

但是当我尝试手动创建此策略时，它也会失败并出现错误:

This policy contains the following error: Has prohibited field Principal For more information about the IAM policy grammar, see AWS IAM Policies.

那么，Code Deploy Application 的预期服务角色是什么？

顺便说一句，代码部署正在我的 EC2 实例上运行。

Answer 1

嗯，根据@Michael 评论，我发现我的服务角色的信任关系策略存在一些差异。

看起来默认的 AWSCodeDeployRole 无法为 Code Deploy 正确处理它。

为了解决这个问题，我替换了“Service”:[
"ec2.amazonaws.com"] 和 "Service": [
“codedeploy.amazonaws.com”]

而且它有效!