amazon-web-services - LabLearner CloudFormation 中的 LabRole

Question

我想使用学习者实验室 AWS ACADEMY 定义的 LabRole。但是，我在如何调用 LabRole 而不是创建新角色时遇到了很多问题和错误，因为 Learner Lab 的权限仅适用于预定义角色(LabRole)，无法创建角色。

我尝试将脚本从 GreengrassV2Workshop 更改为，但它不起作用。`

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation template for AWS IoT Greengrass V2 workshop. Creates various resources like Cloud9, S3, VPC and more.",

  "Mappings" : {
    "CONFIG" : {
        "DEPLOYMENT": { "VERSION" : "2021-05-14" },
        "S3BUCKET": { "NAME": "aws-iot-workshop-artifacts" },
        "S3PREFIX": { "NAME": "resources" }
    }
  },

  "Metadata" : {
    "AWS::CloudFormation::Interface" : {
      "ParameterGroups" : [
        {
          "Label" : { "default": "Cloud9 instance type" },
          "Parameters" : [ "C9InstanceType" ]
        }
      ],
      "ParameterLabels" : {
        "C9InstanceType": { "default" : "AWS Cloud9 instance type" }
      }
    }
  },

  "Parameters" : {
    "C9InstanceType" : {
      "Description" : "A valid EC2 instance type.",
      "Type" : "String",
      "Default" : "t3.large",
      "AllowedValues" : [ "t3.medium", "t3.large", "t3.xlarge" ],
      "ConstraintDescription" : "Must be a valid AWS Cloud9 instance type"
    }
  },


  "Resources" : {

    "LambdaJITRRole": {
       "Type": "AWS::IAM::Role",
       "Properties": {
          "AssumeRolePolicyDocument": {
             "Statement": [ {
                "Effect": "Allow",
                "Principal": {
                   "Service": [ "lambda.amazonaws.com" ]
                },
                "Action": [ "sts:AssumeRole" ]
             } ]
          },
          "Policies": [ {
             "PolicyName": {"Fn::Join": ["", ["IoTWSRegLambdaJITRPolicy-", {"Ref": "AWS::Region"} ]]},
             "PolicyDocument": {
                 "Version":"2012-10-17",
                 "Statement":[
                    {
                       "Effect":"Allow",
                       "Action":[
                          "logs:CreateLogGroup",
                          "logs:CreateLogStream",
                          "logs:PutLogEvents"
                       ],
                       "Resource":"arn:aws:logs:*:*:*"
                    },
                    {
                       "Effect":"Allow",
                       "Action":[
                          "iot:CreateThing",
                          "iot:UpdateCertificate",
                          "iot:CreatePolicy",
                          "iot:AttachPolicy",
                          "iot:DescribeCertificate",
                          "iot:AttachThingPrincipal"
                       ],
                       "Resource":"*"
                    }
                 ]
              }
             }
           ],
          "Path": "/service-role/"
        }
    },

    "C9SecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "VpcId" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.VpcId" ] },
        "GroupDescription" : "Enable access to MQTT port",
        "Tags" : [ { "Key" : "Name", "Value" : "C9 IoT workshop" } ],
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : 8883, "ToPort" : 8883, "CidrIp" : "127.0.0.0/8"}
        ]
      }
    },

    "MiscResources" : {
      "Type" : "AWS::CloudFormation::Stack",
      "Properties" : {
        "TemplateURL" : {
           "Fn::Sub": [
              "https://${S3Bucket}.s3.amazonaws.com/${S3Prefix}/${Version}/cfn/cfn-iot-misc.json",
               {
                 "S3Bucket": { "Fn::FindInMap" : [ "CONFIG", "S3BUCKET", "NAME"] },
                 "S3Prefix": { "Fn::FindInMap" : [ "CONFIG", "S3PREFIX", "NAME"] },
                 "Version": { "Fn::FindInMap" : [ "CONFIG", "DEPLOYMENT", "VERSION"] }
               }
           ]
        }
      }
    },

    "C9Instance" : {
      "Type" : "AWS::CloudFormation::Stack",
      "Properties" : {
        "TemplateURL" : {
           "Fn::Sub": [
              "https://${S3Bucket}.s3.amazonaws.com/${S3Prefix}/${Version}/cfn/cfn-iot-c9-v2.json",
               {
                 "S3Bucket": { "Fn::FindInMap" : [ "CONFIG", "S3BUCKET", "NAME"] },
                 "S3Prefix": { "Fn::FindInMap" : [ "CONFIG", "S3PREFIX", "NAME"] },
                 "Version": { "Fn::FindInMap" : [ "CONFIG", "DEPLOYMENT", "VERSION"] }
               }
           ]
        },
        "Parameters" : {
          "C9InstanceType": { "Ref": "C9InstanceType" },
          "C9ImageId": "ubuntu-18.04-x86_64",
          "C9SecurityGroupId": { "Ref": "C9SecurityGroup" },
          "C9StopTime": 180,
          "IoTPolicy": { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTPolicy" ] },
          "IoTServiceRoleArn": { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleArn" ] },
          "RootStackName": { "Ref": "AWS::StackName" },
          "SubnetId": { "Fn::GetAtt" : [ "MiscResources", "Outputs.PubSubnetIdA" ] },
          "S3BucketArn": { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketArn" ] },
          "S3BucketName": { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketName" ] },
          "Workshop": "AwsWorkshop/IoT/GreengrassV2",
          "UserDataScript": "c9-ub1804-ggv2-user-data.sh"
        }
      }
    }
  },

  "Outputs" : {
    "AWSCloud9URL": {
      "Description": "URL to access your AWS Cloud9 IDE",
      "Value": { "Fn::GetAtt" : [ "C9Instance", "Outputs.AWSCloud9URL" ] }
    },
    "AWSCloud9Id": {
      "Description": "Environment Id of your AWS Cloud9 IDE",
      "Value": { "Fn::GetAtt" : [ "C9Instance", "Outputs.AWSCloud9Id" ] }
    },
    "S3Bucket" : {
      "Description" : "Name of the S3 Bucket for the IoT workshop",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketName" ] }
    },
    "IoTPolicy" : {
      "Description" : "Name of the IoT policy for JITP",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTPolicy" ] }
    },
    "IoTServiceRoleArn" : {
      "Description" : "Role Arn for IoT device provisiong",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleArn" ] }
    },
    "IoTServiceRoleName" : {
      "Description" : "Role name for IoT device provisiong/rule actions",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleName" ] }
    },
    "ArnLambdaRole" : {
      "Description" : "Role Arn for the JITR Lambda function",
      "Value" : { "Fn::GetAtt" : ["LambdaJITRRole", "Arn"] }
    },
    "GGOtaS3UrlSignerRoleArn" : {
      "Description" : "The IAM role arn for OTA which is used to presign the S3 url which links to the Greengrass software update.",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.GGOtaS3UrlSignerRoleArn" ] }
    }
  }
}

`该脚本未创建堆栈，并且显示下一个错误:

Answer 1

在 AWS Academy 中，您无法创建任何 IAM 角色或策略。这是 AWS Academy 帐户的硬限制，您无法更改。