aws-cloudformation - 无服务器框架错误 策略语句必须包含操作

Question

我的 IAM 策略无法使用无服务器框架进行部署。错误消息为(服务:AmazonIdentityManagement；状态代码:400；错误代码:MalformedPolicyDocument；)。该政策如下所示:

DtcServiceFunctionRole:
Type: AWS::IAM::Role
Properties:
  Path: "/"
  RoleName: DtcServiceFunctionRole
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - lambda.amazonaws.com
        Action: sts:AssumeRole
  Policies:
    - PolicyName: dtc-invoke-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - "arn:aws:lambda:us-east-1:xxxxxxxxxxxxx:function:NotificationServiceFunction"
    - PolicyName: dtc-dynamodb-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
            - "dynamodb:BatchGetItem"
            - "dynamodb:BatchWriteItem"
            - "dynamodb:DeleteItem"
            - "dynamodb:GetItem"
            - "dynamodb:PutItem"
            - "dynamodb:Query"
            - "dynamodb:Scan"
            - "dynamodb:UpdateItem"
            Resource:
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/VehicleDtcTable"
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/DtcTable"
          - Effect: Allow

任何帮助我指明正确方向的帮助都会受到赞赏。谢谢。

Answer 1

您的 yaml 似乎没有正确缩进:

        Statement:
      - Effect: Allow
        Action:
        - "dynamodb:BatchGetItem"
        - "dynamodb:BatchWriteItem"
        - "dynamodb:DeleteItem"
        - "dynamodb:GetItem"
        - "dynamodb:PutItem"
        - "dynamodb:Query"
        - "dynamodb:Scan"
        - "dynamodb:UpdateItem"

应该是:

DtcServiceFunctionRole:
Type: AWS::IAM::Role
Properties:
  Path: "/"
  RoleName: DtcServiceFunctionRole
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - lambda.amazonaws.com
        Action: sts:AssumeRole
  Policies:
    - PolicyName: dtc-invoke-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - "arn:aws:lambda:us-east-1:xxxxxxxxxxxxx:function:NotificationServiceFunction"
    - PolicyName: dtc-dynamodb-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "dynamodb:BatchGetItem"
              - "dynamodb:BatchWriteItem"
              - "dynamodb:DeleteItem"
              - "dynamodb:GetItem"
              - "dynamodb:PutItem"
              - "dynamodb:Query"
              - "dynamodb:Scan"
              - "dynamodb:UpdateItem"
            Resource:
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/VehicleDtcTable"
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/DtcTable"
          - Effect: Allow