出现 Cloudformation 错误：未成功创建嵌入式堆栈答案

【问题标题】：Getting Cloudformation error: Embedded stack was not successfully created出现 Cloudformation 错误：未成功创建嵌入式堆栈
【发布时间】：2018-05-18 03:27:12
【问题描述】：

我制作了一个引用 4 个子模板的父（嵌套）堆栈模板。当我通过aws cloudformation create-stack 启动堆栈时，父堆栈出现以下错误：

Embedded stack AlignmentLambdaFunction was not successfully created: The following resource(s) failed to create: [CloudspanLambdaFunction, HaploLambdaExecutionRole, AlignmentLambdaExecutionRole].

我在从父级创建的嵌套堆栈之一中收到此错误：Policy contains a statement with one or more invalid principals（对于 MasterGCPStorageKey（这是上面 Lambda 子级中的资源）

我不明白错误的来源。我想可能是因为 ExecutionRoles 需要一个 DependsOn，但这并没有解决错误。

父堆栈：

AWSTemplateFormatVersion: "2010-09-09"
Description: "Master template for wgs-pipeline. Calls to other stack templates."
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
  AlignmentLambdaFuncS3KeyName:
    Type: String
  AlignmentLambdaFuncModuleName:
    Type: String
  HaploLambdaFuncS3BucketName:
    Type: String
  HaploLambdaFuncS3KeyName:
    Type: String
  HaploLambdaFuncModuleName:
    Type: String
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: 'VPC'
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: 
        Ref: 'VPC'
      InternetGatewayId: 
        Ref: 'InternetGateway'
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Security Group for instances launched in the VPC by Batch
      VpcId: 
        Ref: 'VPC'
  StepFunctionsActivitiesInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 128.218.0.0/16
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/24
      VpcId: 
        Ref: 'VPC'
      AvailabilityZone: 
        Ref: GPCESubnetAZ1
      MapPublicIpOnLaunch: 'True'
    DependsOn: VPC

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: 
        Ref: 'InternetGateway'
    DependsOn:
      - RouteTable
      - InternetGateway
  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      SubnetId: 
        Ref: 'Subnet'
    DependsOn:
      - RouteTable
      - Subnet

  # Beginning of reference to child stacks

  ClouspanLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        CloudspanLambdaFuncS3BucketName: 
          Ref: CloudspanLambdaFuncS3BucketName
        CloudspanLambdaFuncS3KeyName: 
          Ref: CloudspanLambdaFuncS3KeyName
        CloudspanLambdaFuncModuleName: 
          Ref: CloudspanLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  AlignmentLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        AlignmentLambdaFuncS3BucketName: 
          Ref: AlignmentLambdaFuncS3BucketName
        AlignmentLambdaFuncS3KeyName: 
          Ref: AlignmentLambdaFuncS3KeyName
        AlignmentLambdaFuncModuleName: 
          Ref: AlignmentLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  HaploLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        HaploLambdaFuncS3BucketName: 
          Ref: HaploLambdaFuncS3BucketName
        HaploLambdaFuncS3KeyName: 
          Ref: HaploLambdaFuncS3KeyName
        HaploLambdaFuncModuleName: 
          Ref: HaploLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

Lambda 子堆栈（与错误相关）：

AWSTemplateFormatVersion: '2010-09-09'
Description: lambda function and execution role stack.
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  AlignmentLambdaFuncS3KeyName:
    Type: String
    Default: 'alignment_processing.deployable.zip'
  AlignmentLambdaFuncModuleName:
    Type: String
    Default: 'alignment_processing'
  HaploLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  HaploLambdaFuncS3KeyName:
    Type: String
    Default: 'sentieon_haplotyper.deployable.zip'
  HaploLambdaFuncModuleName:
    Type: String
    Default: 'sentieon_haplotyper'
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String


Resources:

  CloudspanLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: CloudspanLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: CloudspanLambdaFuncS3BucketName
        S3Key:
          Ref: CloudspanLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: CloudspanLambdaExecutionRole

  AlignmentLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: AlignmentLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ AlignmentLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: AlignmentLambdaFuncS3BucketName
        S3Key:
          Ref: AlignmentLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: AlignmentLambdaExecutionRole

  HaploLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: HaploLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ HaploLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: HaploLambdaFuncS3BucketName
        S3Key:
          Ref: HaploLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: HaploLambdaExecutionRole


  CloudspanLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*


  AlignmentLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  HaploLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  MasterGCPStorageKey:
    Type: "AWS::KMS::Key"
    Properties:
      Description: Symmetric Master Key for GCP Storage Credentials off-line encryption/on-line decryption protocol
      Enabled: True
      EnableKeyRotation: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
        - Sid: "Allow Lambda Excution Role access to GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of CloudspanLambdaExecutionRole
            AWS:
              Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
          Action:
            - kms:Decrypt
            - kms:DescribeKey
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow Administrator to admin the GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of the KMS admin IAM user
            AWS:
              Ref: KMSAdminUserARN
          Action:
            - "kms:Create*"
            - "kms:Describe*"
            - "kms:Enable*"
            - "kms:List*"
            - "kms:Put*"
            - "kms:Update*"
            - "kms:Revoke*"
            - "kms:Disable*"
            - "kms:Get*"
            - "kms:Delete*"
            - "kms:TagResource"
            - "kms:UntagResource"
            - "kms:ScheduleKeyDeletion"
            - "kms:CancelKeyDeletion"
            - "kms:Encrypt"
            - "kms:Decrypt"
            - "kms:ReEncrypt"
            - "kms:GenerateDataKey*"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow End User to encrypt the GCP Storage creds"
          Effect: "Allow"
          Principal:
            # ARN of the KMS IAM end user
            AWS:
              Ref: KMSEndUserARN
          Action:
            - "kms:Encrypt"
            - "kms:ReEncrypt"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
    DependsOn: CloudspanLambdaExecutionRole

【问题讨论】：

CloudFormation 会为嵌套堆栈报告哪些错误？
@jarmod 当我查看失败的嵌套堆栈时，错误显示 Policy contains a statement with one or more invalid principals for MasterGCPStorageKey（这是上面 Lambda 子项中的资源）
我遇到了类似的错误，角色未创建。我发现已经存在同名角色。由于角色位于 IAM 中，因此它们是全局资源。因此，如果尝试使用现有名称创建 IAM 角色，即使两次尝试部署到不同区域也可能导致冲突。

标签： amazon-web-services templates nested stack amazon-cloudformation

【解决方案1】：

在重新部署已删除的 CloudFormation 堆栈后，我也遇到了以下错误（通过无服务器）：

We encountered the following errors while processing your request:
Policy contains a statement with one or more invalid principals.

就我而言，分配给我的 KMS 加密密钥的原始角色已被删除。 KMS 仍然保留对已删除角色的引用，显然添加相同类型的新创建角色会产生此错误。

我通过简单地删除对已删除角色的旧引用解决了这个问题，在 IAM > Encryption Keys > YOUR_KEY_NAME > Key Policy > Key Users 下

【讨论】：

这里一样，不得不删除已删除（不知道从哪里来）的角色。删除的角色就是“无效的校长”的意思......我想说“无效的角色”太明显了！
google 上出现此错误的两个结果之一。解决它。 GG。
在我的情况下，它是为离开团队的人删除的帐户。