无法仅使用cloudformation创建IAM策略

Question

我遇到了在cloudformation中创建IAM策略的问题.但是当我运行它时,我得到组,角色,用户需要的错误:

这是我的代码:

{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "AWS CloudFormation Template IAM Groups and Policies",
"Resources": {
    "PolicyAutoScalingLimitedOperation": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyName": "AutoScaling-Limited-Operation",
            "PolicyDocument": {
                "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "dynamodb:*"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "cloudwatch:PutMetricData"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "xray:PutTraceSegments",
                            "xray:PutTelemetryRecords"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:Get*",
                            "s3:List*",
                            "s3:PutObject"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "logs:PutLogEvents",
                            "logs:CreateLogStream"
                        ],
                        "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "kms:ListAliases",
                            "kms:ListKeys",
                            "kms:Encrypt",
                            "kms:Decrypt"
                        ],
                        "Resource": "*"
                    }
                ]
            }
        }
    }
}

}

现在,当我运行它时,我得到:

At least one of [Groups,Roles,Users] must be non-empty.

这是否意味着我无法在不添加用户/角色的情况下使用cloudformation创建策略？

Answer 1

AWS::IAM::ManagedPolicy如果您只想要一个独立的策略,您可能想要创建一个.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html

Answer 2

从文档：

AWS::IAM::ManagedPolicy 为您的 AWS 账户创建 AWS Identity and Access Management (IAM) 托管策略，您可以使用该策略将权限应用于 IAM 用户、组和角色。

下面是一个例子：

Resources:
  CreateTestDBPolicy: 
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      Description: "Policy for creating a test database"
      Path: "/"
      PolicyDocument: 
      Version: "2012-10-17"
      Statement: 
        - 
          Effect: "Allow"
          Action: "rds:CreateDBInstance"
          Resource: "*"

这将解决您的问题。