无法仅使用 cloudformation 创建 IAM 策略

Posted 2023-03-04

【中文标题】无法仅使用 cloudformation 创建 IAM 策略

【英文标题】：Cannot create only IAM policy with cloudformation

【发布时间】：2018-02-28 20:24:27

【问题描述】：

我在 cloudformation 中创建 IAM 策略时遇到问题。但是当我运行它时，我得到了 Groups,Roles,Users 是必需的错误：

这是我的代码：

"AWSTemplateFormatVersion": "2010-09-09",
"Description": "AWS CloudFormation Template IAM Groups and Policies",
"Resources": 
    "PolicyAutoScalingLimitedOperation": 
        "Type": "AWS::IAM::Policy",
        "Properties": 
            "PolicyName": "AutoScaling-Limited-Operation",
            "PolicyDocument": 
                "Statement": [
                        "Effect": "Allow",
                        "Action": [
                            "dynamodb:*"
                        ],
                        "Resource": "*"
                    ,
                    
                        "Effect": "Allow",
                        "Action": [
                            "cloudwatch:PutMetricData"
                        ],
                        "Resource": "*"
                    ,
                    
                        "Effect": "Allow",
                        "Action": [
                            "xray:PutTraceSegments",
                            "xray:PutTelemetryRecords"
                        ],
                        "Resource": "*"
                    ,
                    
                        "Effect": "Allow",
                        "Action": [
                            "s3:Get*",
                            "s3:List*",
                            "s3:PutObject"
                        ],
                        "Resource": "*"
                    ,
                    
                        "Effect": "Allow",
                        "Action": [
                            "logs:PutLogEvents",
                            "logs:CreateLogStream"
                        ],
                        "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*"
                    ,
                    
                        "Effect": "Allow",
                        "Action": [
                            "kms:ListAliases",
                            "kms:ListKeys",
                            "kms:Encrypt",
                            "kms:Decrypt"
                        ],
                        "Resource": "*"
                    
                ]
            
        
    

现在当我运行它时，我得到：

At least one of [Groups,Roles,Users] must be non-empty.

这是否意味着如果不向其中添加用户/角色，我就无法使用 cloudformation 创建策略？

【问题讨论】：

文档指出 AWS::IAM::Policy 资源不只是创建策略。它将策略与现有 IAM 组、角色或用户相关联（如此处所示：docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/…）。

【参考方案1】：

来自documentation：

AWS::IAM::ManagedPolicy 创建 AWS Identity and Access Management 您的 AWS 账户的 (IAM) 托管策略，您可以使用它来申请 IAM 用户、组和角色的权限。

这是一个例子：

Resources:
  CreateTestDBPolicy: 
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      Description: "Policy for creating a test database"
      Path: "/"
      PolicyDocument: 
      Version: "2012-10-17"
      Statement: 
        - 
          Effect: "Allow"
          Action: "rds:CreateDBInstance"
          Resource: "*"

这将解决您的问题。

【参考方案2】：

如果您只想要一个独立的策略，您可能想要创建一个AWS::IAM::ManagedPolicy。

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html