amazon-web-services - CloudFormation 声称 KMS 策略声明主体无效

Question

我有以下 SAM 模板:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  test lambda
Globals:
  Function:
    Timeout: 3
    Tracing: Active
  Api:
    TracingEnabled: True

Resources:
  NotesFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Zip
      CodeUri: notes/
      Handler: app.lambdaHandler
      Runtime: nodejs18.x
      Policies:
      - AmazonDynamoDBFullAccess
      Architectures:
        - x86_64
      Events:
        FetchNotes:
          Type: Api
          Properties:
            Path: /notes
            Method: get
        GiveNotes:
          Type: Api
          Properties:
            Path: /notes
            Method: post
        Users:
          Type: Api
          Properties:
            Path: /notes/users
            Method: get
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints:
        - app.ts

  KmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: CMK for encrypting and decrypting
      KeyPolicy:
        Version: '2012-10-17'
        Id: key-default-1
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
          Action: kms:*
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::<MY_ACCOUNT>:role/aws-service-role/cks.kms.amazonaws.com/KMSKeyAdminRole
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS: !Ref NotesFunctionRole
          Action:
          - kms:DescribeKey
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt*
          - kms:GenerateDataKey
          - kms:GenerateDataKeyWithoutPlaintext
          Resource: '*'

  NotesDynamoDB:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: experimental-notes
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      StreamSpecification:
        StreamViewType: NEW_IMAGE

Outputs:
  NotesApi:
    Description: "API Gateway endpoint URL for dev stage for Notes function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/dev/notes/"
  NotesFunction:
    Description: "Notes Lambda Function ARN"
    Value: !GetAtt NotesFunction.Arn
  NotesFunctionIamRole:
    Description: "Implicit IAM Role created for Notes function"
    Value: !GetAtt NotesFunctionRole.Arn
  NotesDynamoDB:
    Description: "DynamoDB table backing the Lambda"
    Value: !GetAtt NotesDynamoDB.Arn

当我构建+部署此模板时，我收到以下 CloudFormation 错误:

Resource handler returned message: "Policy contains a statement with one or more invalid principals....

显然我已经编辑了我的实际帐户 ID 并将其替换为 <MY_ACCOUNT> (!)。

但它没有说明哪些主体是“无效的”。这个想法是第二个策略声明被应用/硬编码到现有角色( KMSKeyAdminRole )。第三条语句适用于 NotesFunction 的角色上面创建了 Lambda。

有人能发现我哪里出了问题吗？

Answer 1

这最终完美地工作并修复了 CF 错误:

- Sid: Allow use of the key
  Effect: Allow
  Principal:
    AWS: !GetAtt FeedbackFunctionRole.Arn
  Action:
  - kms:DescribeKey
  - kms:Encrypt
  - kms:Decrypt
  - kms:ReEncrypt*
  - kms:GenerateDataKey
  - kms:GenerateDataKeyWithoutPlaintext
  Resource: '*'