如何允许 IAM 角色通过 cloudformation 承担另一个 IAM 角色？

Question

通过 cloudformation 添加 IAM 角色，我想在其中添加信任策略，以便来自另一个 aws 账户的另一个 IAM 角色 (arn:aws:iam::123456789:role/otherrole) 可以担任我的角色。但我收到错误“已禁止字段资源（服务：AmazonIdentityManagement；状态代码：400 .....

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  SomeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Resource: arn:aws:iam::123456789:role/otherrole
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
      ...

Answer 1

AssumeRolePolicyDocument 没有Resource。应该是Principal:

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  SomeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: 
              AWS: arn:aws:iam::123456789:role/otherrole
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
      ...