代码之家  ›  专栏  ›  技术社区  ›  nad87563

用于创建具有内联策略的IAM角色的cloudformation模板

  •  5
  • nad87563  · 技术社区  · 8 年前

    我正在尝试使用以下模板创建IAM角色。我能够使用托管策略创建角色。当我尝试在模板中添加内联策略时,我得到了一个错误

    “属性PolicyDocument不能为空。”

    {
    "Resources": {
    "test": {
          "Type": "AWS::IAM::Role",
          "Properties": {
            "AssumeRolePolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Principal": {
                    "Service": [
                      "ec2.amazonaws.com"
                    ]
                  },
                  "Action": [
                    "sts:AssumeRole"
                  ]
                }
              ]
            },
            "ManagedPolicyArns": [
              "arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess",
              "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole",
            ],
          "Policies": [
          "PolicyName" : "create_snapshot",
          "PolicyDocument" : {
             "Version" : "2012-10-17",
             "Statement": [ {
             "Effect"   : "Allow",
             "Action": [
                    "ec2:DeleteSnapshot",
                    "ec2:CreateTags",
                    "ec2:CreateSnapshot"
                ],
             "Resource" : "*"
             } ]      
          }
    ],
    "RoleName": "test"
          }
        }
    }
    }    
    
    1 回复  |  直到 8 年前
        1
  •  4
  •   jarmod    8 年前

    策略是一个策略对象列表,其编写如下,每个单独的策略对象都嵌入在[]列表中的大括号中:

    "Policies": [ {
        "PolicyName" : "policy01",
        "PolicyDocument" : { ... }
    }, {
        "PolicyName" : "policy02",
        "PolicyDocument" : { ... }
    } ]