我尝试在SSM中使用AWS的SNS,但却收到有关角色的错误。
这是错误:
botocore.errorfactory.InvalidRole: An error occurred (InvalidRole) when calling the SendCommand operation: ServiceRoleArn is not valid: arn:aws:iam::<account #>:role/FullSNS
以下是相关代码:
response = client.send_command(
InstanceIds=[
'<instance id>',
],
DocumentName='AWS-RunShellScript',
Parameters={
'commands': [
'<command>',
],
'workingDirectory': [
'<directory>'
]
},
OutputS3BucketName='<s3 bucket>',
ServiceRoleArn='arn:aws:iam::<account #>:role/FullSNS',
NotificationConfig={
'NotificationArn': 'arn:aws:sns:us-east-1:<account #>:MyTestTopic',
'NotificationEvents': [
'All',
],
'NotificationType': 'Command'
}
)
以下是关于该角色的政策:
{
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"sns:*"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
上面是boto3,但是如果我在控制台中尝试它,我会得到同样的错误。
答案 0 :(得分:5)
我希望AWS文档在这一点上更加明确,但我还必须编辑该IAM角色的信任关系,如下所示:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ssm.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}