amazon-elastic-beanstalk - 使用 CloudFormation 创建 BeanStalk 应用程序时如何修复 "Insufficient privileges for IAM PassRole Action"？

Question

当我尝试使用 CloudFormation 创建弹性 beanstalk 应用程序时，资源创建失败:

IAM PassRole 操作的权限不足。 (服务:AWSElasticBeanstalk；状态代码:403；错误代码:InsufficientPrivilegesException；请求 ID:[...]；代理:null)

我该如何解决这个问题？

CloudFormation 模板:

  BeanStalkServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: elasticbeanstalk.amazonaws.com
            Condition:
              StringEquals:
                'sts:ExternalId': elasticbeanstalk
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
        - arn:aws:iam::aws:policy/service-role/AWSElasticBeanstalkEnhancedHealth

  BeanStalkApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: Java Backend
      ResourceLifecycleConfig:
        ServiceRole: !Ref BeanStalkServiceRole
        VersionLifecycleConfig:
          MaxAgeRule:
            DeleteSourceFromS3: true
            Enabled: true
            MaxAgeInDays: 30

Answer 1

ServiceRole 属性必须指向角色 ARN，即 !GetAtt BeanStalkServiceRole.Arn 而不是 !Ref BeanStalkServiceRole:

  BeanStalkApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: Java Backend
      ResourceLifecycleConfig:
        ServiceRole: !GetAtt BeanStalkServiceRole.Arn
        VersionLifecycleConfig:
          MaxAgeRule:
            DeleteSourceFromS3: true
            Enabled: true
            MaxAgeInDays: 30

感谢https://github.com/hashicorp/terraform-provider-aws/issues/17576