【发布时间】：2020-04-11 15:09:20
【问题描述】：
我有一个如下所示的 CF 模板
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: gtm platform Lampda application deployment for ELasticCloud
Parameters:
SystemUserAccount:
Description: The syatem user account used to assume deployment role
Type: String
Default: usr-test1
DeploymentRoleName:
Description: The deployment role used to deploy cloudformation template
Type: String
Default: gtm-platform-deployment-role
GTMPlatformLambdaRoleName:
Description: The execution role for gtm platform
Type: String
Default: gtm-platform-lambda-role
GTMPlatformKMSKeyAliasName:
Description: The lambda function name for gtm platform
Type: String
Default: gtm-platform-kms-key
Resources:
GTMPlatformLambdaRole:
Type: AWS::IAM::Role
DependsOn:
- GTMPlatformKMSKey
Properties:
RoleName: !Ref GTMPlatformLambdaRoleName
AssumeRolePolicyDocument:
Version: '2008-10-17'
Statement:
- Sid: ''
Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
Path: /
ManagedPolicyArns:
- arn:aws:iam::aws:policy/CloudWatchFullAccess
- arn:aws:iam::aws:policy/AmazonVPCFullAccess
Policies:
- PolicyName: GTMPlatformLambdaPolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action: cloudwatch:*
Resource: "*"
- Effect: Allow
Action:
- kms:EnableKeyRotation
- kms:EnableKey
- kms:ImportKeyMaterial
- kms:Decrypt
- kms:UntagResource
- kms:UpdateKeyDescription
- kms:GetKeyPolicy
- kms:GenerateDataKeyWithoutPlaintext
- kms:CancelKeyDeletion
- kms:ListResourceTags
- kms:DeleteImportedKeyMaterial
- kms:DisableKey
- kms:DisableKeyRotation
- kms:ListGrants
- kms:UpdateAlias
- kms:GetParametersForImport
- kms:TagResource
- kms:Encrypt
- kms:GetKeyRotationStatus
- kms:ScheduleKeyDeletion
- kms:CreateAlias
- kms:DescribeKey
- kms:DeleteAlias
Resource: !GetAtt GTMPlatformKMSKey.Arn
- Effect: Allow
Action:
- kms:GenerateRandom
- kms:GenerateDataKey
- kms:ReEncryptTo
- kms:ReEncryptFrom
Resource: "*"
GTMPlatformKMSKey:
Type: AWS::KMS::Key
Properties:
Description: Key used to encrypt decrypt EBS volumes at rest
Enabled: true
KeyPolicy:
Version: '2012-10-17'
Statement:
- Sid: Enable permissions for admin
Effect: Allow
Principal:
AWS: !Join
- ''
- - 'arn:aws:iam::'
- !Ref 'AWS::AccountId'
- ':root'
Action:
- 'kms:*'
Resource: '*'
- Sid: Allow access for Key Administrators
Effect: Allow
Principal:
AWS:
- !Sub
- 'arn:aws:iam::${accountId}:role/${gtmDeploymentRoleName}'
- accountId: !Ref 'AWS::AccountId'
gtmDeploymentRoleName: !Ref 'DeploymentRoleName'
Action:
- kms:Create*
- kms:Describe*
- kms:Enable*
- kms:List*
- kms:Put*
- kms:Update*
- kms:Revoke*
- kms:Disable*
- kms:Get*
- kms:Delete*
- kms:TagResource
- kms:UntagResource
Resource: "*"
- Sid: Allow use of the key
Effect: Allow
Principal:
AWS:
- !Sub
- 'arn:aws:iam::${accountId}:role/${gtmPlatformLambdaRoleName}'
- accountId: !Ref 'AWS::AccountId'
gtmPlatformLambdaRoleName: !Ref 'GTMPlatformLambdaRoleName'
Action:
- kms:Encrypt
- kms:Decrypt
- kms:ReEncrypt*
- kms:GenerateDataKey*
- kms:DescribeKey
Resource: "*"
- Sid: Allow attachment of persistent resources
Effect: Allow
Principal:
AWS:
- !Sub
- 'arn:aws:iam::${accountId}:role/${gtmPlatformLambdaRoleName}'
- accountId: !Ref 'AWS::AccountId'
gtmPlatformLambdaRoleName: !Ref 'GTMPlatformLambdaRoleName'
Action:
- kms:CreateGrant
- kms:ListGrants
- kms:RevokeGrant
Resource: "*"
Condition:
Bool:
kms:GrantIsForAWSResource: 'true'
GTMPlatformKMSKeyAlias:
Type: AWS::KMS::Alias
DependsOn:
- GTMPlatformKMSKey
Properties:
AliasName: !Join ['/', ['alias', !Ref GTMPlatformKMSKeyAliasName]]
TargetKeyId: !GetAtt GTMPlatformKMSKey.Arn
创建资源GTMPlatformKMSKey 时出现错误。它失败并显示CREATE_FAILED 和错误消息
Policy contains a statement with one or more invalid principals. (Service: AWSKMS; Status Code: 400; Error Code: MalformedPolicyDocumentException; Request ID: 5673456f-b458-45c6-854b-9ed63c737772)
如果我从 GTMPlatformKMSKey 中删除 Sid Allow use of the key 和 Allow attachment of persistent resources，则模板运行良好。不知道我在这里缺少什么。非常感谢任何帮助
附： - 资源SystemUserAccount 和DeploymentRoleName 已经存在于环境中
编辑 - 根据建议将模板缩减为仅包含失败的资源
【问题讨论】：
-
sid可以包含空格吗？给 SID 一个不带空格的值
-
您能否将模板缩减为最相关的部分？ （也就是说，删除不影响您的特定问题的部分。）这样，我们可以尝试诊断或重现。有关提出好问题的提示，请参阅：How do I ask a good question?
-
@JohnRotenstein 我把模板缩小了，你现在可以看一下吗
-
哪个特定策略产生了错误？
-
您为什么将
!Sub与地图/数组一起使用？像String一样传递它，例如：` !Sub 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}' `。错误在于您尝试构建主体的方式，如下所示：``` Principal: AWS: - !Sub - 'arn:aws:iam::${accountId}:role/${gtmDeploymentRoleName}' - accountId : !Ref 'AWS::AccountId' gtmDeploymentRoleName: !Ref 'DeploymentRoleName' ``
标签： aws-lambda amazon-cloudformation aws-serverless aws-kms