Question

我遇到了在cloudformation中创建IAM策略的问题。但是当我运行它时，我收到组，角色，用户需要的错误：

这是我的代码：

{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "AWS CloudFormation Template IAM Groups and Policies",
"Resources": {
    "PolicyAutoScalingLimitedOperation": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyName": "AutoScaling-Limited-Operation",
            "PolicyDocument": {
                "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "dynamodb:*"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "cloudwatch:PutMetricData"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "xray:PutTraceSegments",
                            "xray:PutTelemetryRecords"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:Get*",
                            "s3:List*",
                            "s3:PutObject"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "logs:PutLogEvents",
                            "logs:CreateLogStream"
                        ],
                        "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "kms:ListAliases",
                            "kms:ListKeys",
                            "kms:Encrypt",
                            "kms:Decrypt"
                        ],
                        "Resource": "*"
                    }
                ]
            }
        }
    }
}

}

现在，当我运行它时，我得到了：

At least one of [Groups,Roles,Users] must be non-empty.

这是否意味着我无法在不添加用户/角色的情况下使用cloudformation创建策略？

Answer 1

如果您只想要一个独立的策略，则可能需要创建AWS::IAM::ManagedPolicy。

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html

Answer 2

来自documentation：

AWS :: IAM :: ManagedPolicy创建一个AWS Identity and Access Management （IAM）您的AWS账户的托管策略，可用于应用 IAM用户，组和角色的权限。

这是一个例子：

Resources:
  CreateTestDBPolicy: 
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      Description: "Policy for creating a test database"
      Path: "/"
      PolicyDocument: 
      Version: "2012-10-17"
      Statement: 
        - 
          Effect: "Allow"
          Action: "rds:CreateDBInstance"
          Resource: "*"

这将解决您的问题。

无法仅使用cloudformation创建IAM策略

2 个答案: