amazon-web-services - 当 IAM 配置文件和 EC2 策略引用角色时，如何避免 IAM 依赖性阻止 CFT 删除

Question

我的 CFT 包含以下 5 种资源:

MasterAsg:
  Type: AWS::AutoScaling::AutoScalingGroup
  Properties:
    ...
    LaunchConfigurationName:
      Ref: MasterLaunchConfig
MasterLaunchConfig:
  Type: AWS::AutoScaling::LaunchConfiguration
  Properties:
    ...
    IamInstanceProfile:
      Ref: MasterIntanceProfile
MasterIntanceProfile:
  Type: AWS::IAM::InstanceProfile
  Properties:
    Roles:
      - Ref: MasterIamRole
MasterIamRole:
  Type: AWS::IAM::Role
  Properties:
    ...
MasterIamPolicy:
  Type: AWS::IAM::Policy
  Properties:
    Roles:
      - Ref: MasterIamRole
    ...

下图展示了它们如何相互依赖。

我遇到过一些情况，其中该 CFT 的不同部分失败并导致堆栈回滚。以下是我收到的错误:

[MasterIamRole] Cannot delete entity, must detach all policies first. (Service: AmazonIdentityManagement; Status Code: 409; Error Code: DeleteConflict

如何更改这些资源的创建方式或向该堆栈添加正确的 DependsOn 属性以防止将来遇到这种情况？

Answer 1

我最终将策略直接附加到角色，如本示例所示:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#aws-resource-iam-role-example1.yaml