aws-cdk - 默认凭据不能用于承担新样式部署角色

Question

关注 pipelines readme为了建立一个部署管道，我跑了

$ env CDK_NEW_BOOTSTRAP=1 npx cdk bootstrap \
    --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess \
    aws://[ACCOUNT_ID]/us-west-2

创建必要的角色。我会假设角色会从我的帐户原则中自动添加 sts 承担角色权限。但是，当我运行 cdk deploy 时我收到以下警告

current credentials could not be used to assume'arn:aws:iam::[ACCOUNT_ID]:role/cdk-hnb659fds-file-publishing-role-[ACCOUNT_ID]-us-west-2',but are for the right account. Proceeding anyway.

我在 ~/.aws/credentials 中有 root 凭据.
查看部署角色策略，我没有看到任何 sts 权限。我错过了什么？

Answer 1

您将需要为您尝试执行的凭据添加承担角色的权限 cdk deploy

{
  "Sid": "assumerole",
  "Effect": "Allow",
  "Action": [
     "sts:AssumeRole",
     "iam:PassRole"
  ],
  "Resource": [
     "arn:aws-cn:iam::*:role/cdk-readOnlyRole",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-deploy-role-*",
     "arn:aws-cn:iam::*:role/cdk-hnb659fds-file-publishing-*"
  ]
}