创建 AWS/IAM 策略时获取“策略未能通过旧版解析”答案

【问题标题】：Getting 'The policy failed legacy parsing' when creating an AWS/IAM policy创建 AWS/IAM 策略时获取“策略未能通过旧版解析”
【发布时间】：2019-10-31 00:46:31
【问题描述】：

我正在尝试创建一个策略，其 JSON 为：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "kms:UntagResource",
                "kms:ListKeyPolicies",
                "kms:ListRetirableGrants",
                "kms:GetKeyPolicy",
                "iam:ListRoles",
                "kms:ListResourceTags",
                "iam:ListInstanceProfiles",
                "kms:ListGrants",
                "kms:GetParametersForImport",
                "kms:DescribeCustomKeyStores",
                "kms:ListKeys",
                "kms:TagResource",
                "s3:ListAllMyBuckets",
                "kms:GetKeyRotationStatus",
                "kms:ListAliases",
                "kms:DescribeKey",
                "s3:HeadBucket"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::644748426467:"
        }
    ]
}

但是当我点击 Review Policy 时，我得到了The policy failed legacy parsing（见下面的截图）。

知道我的错误语法是什么吗？

编辑 1：

以下给出相同的The policy failed legacy parsing 错误：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "kms:ListKeyPolicies",
                "kms:UntagResource",
                "kms:ListRetirableGrants",
                "kms:GetKeyPolicy",
                "iam:ListRoles",
                "kms:ListResourceTags",
                "iam:ListInstanceProfiles",
                "kms:ListGrants",
                "kms:GetParametersForImport",
                "kms:DescribeCustomKeyStores",
                "kms:ListKeys",
                "kms:TagResource",
                "kms:GetKeyRotationStatus",
                "kms:ListAliases",
                "kms:DescribeKey"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "s3:ListBucket",
            "Resource": [
                "arn:aws:s3:::*"
            ]
        }
    ]
}

【问题讨论】：

我已经测试了这个策略并且效果很好，您是否有任何其他策略附加到这个特定的角色？
确保 644748426467 桶存在
@Amit，见Edit 1。此角色没有附加任何其他政策。
stackoverflow.com/a/56473136/9931092

标签： amazon-web-services amazon-s3 amazon-iam aws-kms

【解决方案1】：

我找到了正确的政策格式。

从IAM/edit-policy GUI 输入资源时，生成的 JSON 将更新为错误格式。
S3 权限的正确格式应该是 arn:aws:s3:::xxxxxx 而不是 arn:aws:::xxxxxx:。
请注意，当您在 JSON 中手动输入格式正确的 S3 资源时，GUI 会显示警告。

这是我的工作 JSON：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "kms:GetParametersForImport",
                "kms:TagResource",
                "kms:UntagResource",
                "kms:ListKeyPolicies",
                "kms:ListRetirableGrants",
                "kms:GetKeyRotationStatus",
                "kms:GetKeyPolicy",
                "cloudtrail:CreateTrail",
                "kms:DescribeKey",
                "s3:ListBucket",
                "kms:ListResourceTags",
                "kms:ListGrants"
            ],
            "Resource": [
                "arn:aws:s3:::644748xxxxxx",
                "arn:aws:kms:*:644748xxxxxx:key/*",
                "arn:aws:kms:*:644748xxxxxx:alias/*",
                "arn:aws:cloudtrail:::*"
            ]
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "iam:ListPolicies",
                "kms:DescribeCustomKeyStores",
                "kms:ListKeys",
                "iam:GetPolicyVersion",
                "iam:GetRole",
                "iam:CreateServiceLinkedRole",
                "kms:ListAliases",
                "iam:ListRoles",
                "iam:ListRolePolicies",
                "iam:ListInstanceProfiles"
            ],
            "Resource": "*"
        }
    ]
}

【讨论】：