将EC2 SNS与SSM一起使用时出错(Systems Manager)

时间:2017-08-03 04:19:00

标签: amazon-ec2 boto3 amazon-sns amazon-iam ssm

我尝试在SSM中使用AWS的SNS,但却收到有关角色的错误。

这是错误:

botocore.errorfactory.InvalidRole: An error occurred (InvalidRole) when calling the SendCommand operation: ServiceRoleArn is not valid: arn:aws:iam::<account #>:role/FullSNS

以下是相关代码:

response = client.send_command(
InstanceIds=[
    '<instance id>',
],
DocumentName='AWS-RunShellScript',
Parameters={
    'commands': [
        '<command>',
    ],
    'workingDirectory': [
        '<directory>'
    ]
},
OutputS3BucketName='<s3 bucket>',
ServiceRoleArn='arn:aws:iam::<account #>:role/FullSNS',
NotificationConfig={
    'NotificationArn': 'arn:aws:sns:us-east-1:<account #>:MyTestTopic',
    'NotificationEvents': [
        'All',
        ],
    'NotificationType': 'Command'
    }
)

以下是关于该角色的政策:

{
  "Version": "2012-10-17",
  "Statement": [
{
  "Action": [
    "sns:*"
  ],
  "Effect": "Allow",
  "Resource": "*"
}
]
}

上面是boto3,但是如果我在控制台中尝试它,我会得到同样的错误。

1 个答案:

答案 0 :(得分:5)

我希望AWS文档在这一点上更加明确,但我还必须编辑该IAM角色的信任关系,如下所示:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
         "Service": "ssm.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}