amazon-web-services - AWS IAM Cloudformation YAML 模板错误 : 'null' values are not allowed

Question

我正在为 IAM 角色开发 Cloudformation 模板，该角色授予跨账户只读访问权限。它还使用托管策略进行只读访问。到目前为止，我已经解决了几个错误，但现在当我尝试验证模板时，出现“模板中不允许使用‘null’值”错误。我认为这是一个空格或语法问题，但我不能确定，因为这是我第一次从头开始并使用 YAML 创建 cloudformation 模板。

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation template IAM Role for New Relic to have read access to AWS account
Resources:
  NewRelicInfrastructure-IntegrationsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        Effect: Allow
        Principal:
          AWS: 11111111
        Action: sts:AssumeRole
        Condition:
          StringEquals:
          sts:ExternalId: '11111'
  Path: '/'
  ManagedPolicyArns: arn:aws:iam::aws:policy/ReadOnlyAccess
  RoleName: NewRelicInfrastructure-Integrations2

Answer 1

问题出在 AssumeRolePolicyDocument: 上。这是必需的，但您将其留空。您还存在缩进问题，其中 Path、ManagedPolicyArns 和 RoleName 位于 Resources 下，而不是 Properties.

尝试:

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation template IAM Role for New Relic to have read access to AWS account
Resources:
  NewRelicInfrastructure-IntegrationsRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          Effect: Allow
          Principal:
            AWS: 11111111
          Action: sts:AssumeRole
          Condition:
            StringEquals:
            sts:ExternalId: '11111'
      Path: '/'
      ManagedPolicyArns: arn:aws:iam::aws:policy/ReadOnlyAccess
      RoleName: NewRelicInfrastructure-Integrations2