Cloudformation 模板为 SQS 创建角色答案

【问题标题】：Cloudformation template to create a role for SQSCloudformation 模板为 SQS 创建角色
【发布时间】：2017-05-16 19:02:05
【问题描述】：

我正在尝试使用 cloudformation 模板创建具有嵌入式策略的角色：

{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
  "SQSRole": {
     "Type": "AWS::IAM::Role",
     "Properties": {
        "AssumeRolePolicyDocument": {
           "Version" : "2012-10-17",
           "Statement": [ {
              "Effect": "Allow",
              "Principal": {
                 "Service": [ "sqs.amazonaws.com" ]
              },
              "Action": [
                    "SQS:SendMessage",
                    "SQS:ReceiveMessage",
                    "SQS:DeleteMessage",
                    "SQS:GetQueueUrl"
                ]
           } ]
        },
        "Path": "/"
        }
  },
  "RootInstanceProfile": {
     "Type": "AWS::IAM::InstanceProfile",
     "Properties": {
        "Path": "/",
        "Roles": [ {
           "Ref": "SQSRole"
        } ]
     }
  }
}
}

它给出错误“策略中的主体无效：“SERVICE”：“sqs.amazonaws.com”。

我还尝试替换 SQS 队列的确切 URL："SERVICE":"sqs.ap-south-1.amazonaws.com/710161973367/CFI-Trace"

它仍然给出同样的错误。不确定为 sqs 指定什么服务。

【问题讨论】：

标签： amazon-web-services amazon-sqs amazon-cloudformation

【解决方案1】：

如果您尝试创建由 EC2 实例代入的 IAM 角色，则应改为使用此角色：

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "SQSRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "ec2.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "SqsAccess",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Sid": "1",
                  "Effect": "Allow",
                  "Action": [
                    "SQS:SendMessage",
                    "SQS:ReceiveMessage",
                    "SQS:DeleteMessage",
                    "SQS:GetQueueUrl"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "RootInstanceProfile": {
      "Type": "AWS::IAM::InstanceProfile",
      "Properties": {
        "Path": "/",
        "Roles": [
          {
            "Ref": "SQSRole"
          }
        ]
      }
    }
  }
}

请注意，代入您的 IAM 角色的服务现在是 ec2.amazonaws.com。此外，现在只允许 EC2 服务担任您的 IAM 角色（通过sts:AssumeRole）。最后，您的所有 sqs:* 操作都已移至 IAM 角色的 Policies 属性中。

【讨论】：