amazon-web-services - 部署 CloudFormation 堆栈以创建 ElasticBeanstalk 应用程序时出现 InsufficientPrivilegesException

Question

我编写了一个用于创建 ElasticBeanstalk 应用程序的 CloudFormation 模板。但是，当我执行模板时，收到以下错误:访问被拒绝(服务:AWSElasticBeanstalk；状态代码:403；错误代码:InsufficientPrivilegesException；请求 ID:6c580af3-250d-4658-bc2f-8f6af4c1dd6d；代理:null )。

我需要添加什么权限？

我的 CloudFormation 脚本的相关部分:

# The role used by CloudFormation to create the stack
CFNRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Action: ["sts:AssumeRole"]
          Effect: Allow
          Principal:
            Service: [cloudformation.amazonaws.com]
      Version: "2012-10-17"
    Path: /
    Policies:
      - PolicyName: CloudFormationRole
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Action:
                - "ec2:*"
                - "elasticbeanstalk:*"
                - "iam:*"
                - "lambda:*"
                - "logs:*"
              Effect: Allow
              Resource: "*"

# more stuff here... 

# Create the EB app without an Environment for now
EBApp1:
  Type: AWS::ElasticBeanstalk::Application
  Properties:
    Description: my-api

Answer 1

事实证明我缺少 CFNRole 的 S3 权限。我将权限修改为以下内容，并且可以部署堆栈。

CFNRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Action: ["sts:AssumeRole"]
          Effect: Allow
          Principal:
            Service: [cloudformation.amazonaws.com]
      Version: "2012-10-17"
    Path: /
    Policies:
      - PolicyName: CloudFormationRole
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Action:
                - "ec2:*"
                - "elasticbeanstalk:*"
                - "iam:*"
                - "lambda:*"
                - "logs:*"
                - "s3:*" #### Added this line ####
              Effect: Allow
              Resource: "*"