amazon-web-services - 用于为 SQS 创建角色的 Cloudformation 模板

Question

我正在尝试使用 cloudformation 模板创建具有嵌入式策略的角色:

{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
  "SQSRole": {
     "Type": "AWS::IAM::Role",
     "Properties": {
        "AssumeRolePolicyDocument": {
           "Version" : "2012-10-17",
           "Statement": [ {
              "Effect": "Allow",
              "Principal": {
                 "Service": [ "sqs.amazonaws.com" ]
              },
              "Action": [
                    "SQS:SendMessage",
                    "SQS:ReceiveMessage",
                    "SQS:DeleteMessage",
                    "SQS:GetQueueUrl"
                ]
           } ]
        },
        "Path": "/"
        }
  },
  "RootInstanceProfile": {
     "Type": "AWS::IAM::InstanceProfile",
     "Properties": {
        "Path": "/",
        "Roles": [ {
           "Ref": "SQSRole"
        } ]
     }
  }
}
}

它给出错误“策略中的主体无效:“SERVICE”:“sqs.amazonaws.com”。

我还尝试替换 SQS 队列的确切 URL:“SERVICE”:“sqs.ap-south-1.amazonaws.com/710161973367/CFI-Trace”

仍然给出同样的错误。不确定要为 sqs 指定什么服务。

Answer 1

如果您尝试创建由 EC2 实例承担的 IAM 角色，则应改用此角色:

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "SQSRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "SqsAccess",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "1",
                  "Effect": "Allow",
                  "Action": [
                    "SQS:SendMessage",
                    "SQS:ReceiveMessage",
                    "SQS:DeleteMessage",
                    "SQS:GetQueueUrl"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "RootInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [
          {
            "Ref": "SQSRole"
          }
        ]
      }
    }
  }
}

请注意，将承担您的 IAM 角色的服务现在是 ec2.amazonaws.com。此外，EC2 服务现在只允许代入您的 IAM 角色(通过 sts:AssumeRole)。最后，您的所有 sqs:* 操作均已移至 IAM 角色的 Policies 属性中。