原则上通过 CloudFormation 错误的 IAM 角色

Question

我正在尝试通过 cloudformation 为现有的 IAM 用户创建一个 IAM 角色作为主体和一个现有的 dynamodb 表。我已经通过 yamllint 进行了验证，yaml 格式正确，但 cloudformation 抱怨文件格式错误。

以下是我的 cloudformation 模板：

    AWSTemplateFormatVersion: 2010-09-09
    Parameters:
      vTableName:
        Type: String
        Description: the tablename
        Default: arn:aws:dynamodb:ap-southeast-2:1234567:table/test-table
      vUserName:
        Type: String
        Description: New account username
        Default: mytestuser
    Resources:
      DynamoRoleForTest:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${vUserName}'  
              Action:
              - sts:AssumeRole    
          Path: /
          Policies:
            - PolicyName: DynamoPolicy
              PolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: Allow
                  - Action:
                      - dynamodb:BatchGet*
                      - dynamodb:DescribeStream
                      - dynamodb:DescribeTable
                      - dynamodb:Get*
                      - dynamodb:Query
                      - dynamodb:Scan                                    
                    Resource: !Ref vTableName

以下是我在尝试创建此模板时收到的错误：

策略中的语法错误。 （服务：AmazonIdentityManagement；状态代码：400；错误代码：MalformedPolicyDocument；请求 ID：237dd218-a2a2-4194-9063-104f8022cb80）

感谢您的建议。

Answer 1

您的Action 中有不需要的-：

- Action:

因此，您的模板应该是（删除-）：

    AWSTemplateFormatVersion: 2010-09-09
    Parameters:
      vTableName:
        Type: String
        Description: the tablename
        Default: arn:aws:dynamodb:ap-southeast-2:1234567:table/test-table
      vUserName:
        Type: String
        Description: New account username
        Default: mytestuser
    Resources:
      DynamoRoleForTest:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Statement:
            - Effect: Allow
              Principal:
                AWS:
                - !Sub 'arn:aws:iam::${AWS::AccountId}:user/${vUserName}'  
              Action:
              - sts:AssumeRole    
          Path: /
          Policies:
            - PolicyName: DynamoPolicy
              PolicyDocument:
                Version: 2012-10-17
                Statement:
                  - Effect: Allow
                    Action:
                      - dynamodb:BatchGet*
                      - dynamodb:DescribeStream
                      - dynamodb:DescribeTable
                      - dynamodb:Get*
                      - dynamodb:Query
                      - dynamodb:Scan                                    
                    Resource: !Ref vTableName

Principle 很好，假设它存在。