amazon-web-services - 如何在创建 yml 的同时在 AWS lambda 中创建新的 IAM::ROLE

Question

在AWS云形成模板中如何创建新的lambda(test_lambda_role)角色

可以访问 s3:getObject、RDS 访问(rds-db:connect)，

Resources:
    Role:  
        Type: AWS::IAM::Role
        Properties:
            RoleName: !Sub test_lambda_role
            AssumeRolePolicyDocument:
                Version: '2012-10-17'
                Statement:
                    - Effect: Allow
                      Principal: 
                          Lambda:
                              - !Sub "arn:aws:iam::${AWS::AccountId}:saml-provider/${pSamlProviderAdmin}"
                      Action: 
                        - rds-db:connect

Lambda 函数未使用上述模板创建

Answer 1

AssumeRolePolicyDocument 用于信任策略，如下所述:

• Creating a role to delegate permissions to an AWS service

因此，仅具有 lambda 执行角色的模板可以是:

AWSTemplateFormatVersion: 2010-09-09

Parameters: 

  testlambdarole:
    Type: String
    Default: role-name
      
Resources: 

  Role:  
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref testlambdarole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'               
        Statement:
          - Effect: Allow
            Principal: {'Service': ['lambda.amazonaws.com']}
            Action: ['sts:AssumeRole']      
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSLambdaExecute
      Policies:
        - PolicyName: S3Access
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action: 
                  - s3:getObject
                Resource: "*"
        - PolicyName: RdsAccess
          PolicyDocument: 
            Version: "2012-10-17"
            Statement: 
              - Effect: "Allow"
                Action: 
                  - rds-db:connect
                Resource: "*"

您需要根据您的需要调整策略。