amazon-web-services - 计划创建一个需要 3 个角色的 CFT，其中包含托管策略和附加的内联策略

Question

我正在尝试创建一个 CFT，其中包含1. 具有托管策略的 3 个不同角色2. INline策略应该添加到CFT中创建的三个角色中。

但我无法这样做，因为这会引发错误，说明必须定义至少一个资源。

请帮助我实现这一目标。

{ "AWSTemplateFormatVersion": "2010-09-09", “资源”:{

    "EMRDefaultRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "RoleName": "EMR_DefaultRole",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "elasticmapreduce.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }]
            },
            "ManagedPolicyArns": [
                "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole"
            ]
        }
    },
    "EMREC2DefaultRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "RoleName": "EMR_EC2_DefaultRole",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }]
            },
            "ManagedPolicyArns": [
                "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"
            ]
        }
    },
    "EMRAutoScalingDefaultRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "RoleName": "EMR_AutoScaling_DefaultRole",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [ "elasticmapreduce.amazonaws.com",
                        "application-autoscaling.amazonaws.com"]
                    },
                    "Action": "sts:AssumeRole"
                }]
            },
            "ManagedPolicyArns": [
                "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforAutoScalingRole"
            ]
        }
    },
    "EMRS3Policies": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyName": "Moodys-IAM-EMR-S3-Access-Policy",
            "PolicyDocument": {
                "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "s3:HeadBucket",
                            "s3:GetObject"
                        ],
                        "Resource": {
                            "Fn::Join": ["", ["arn:aws:s3:::mit-", {
                                "Ref": "AWS::AccountId"
                            }, "-emr-files/*"]]
                        }
                    }

                ]
            },
            "Roles": [{
                "Ref": "EMRDefaultRole"},
                {"Ref": "EMREC2DefaultRole"},
                {"Ref": "EMRAutoScalingDefaultRole"
            }]
        }
    }
}

}

就像我期待三个角色，其中附加了托管策略和内联策略。

Answer 1

您的角色语句中缺少resource 属性。

"Statement": [{
    "Effect": "Allow",
    "Principal": {
        "Service": [ "elasticmapreduce.amazonaws.com",
        "application-autoscaling.amazonaws.com"]
     },
     "Action": "sts:AssumeRole"
 }]

这应该是(它适用于所有陈述)

 "Statement": [{
    "Effect": "Allow",
    "Principal": {
        "Service": [ "elasticmapreduce.amazonaws.com",
        "application-autoscaling.amazonaws.com"]
     },
     "Action": "sts:AssumeRole",
     "Resource": [
         "arn-of-your-resource-or-wildcard"
     ]
 }]