无效的策略角色 JSON

Question

我正在关注本教程：

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-cli-tutorial-fargate.html

策略的 json 如下所示：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ecs-tasks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

但是当我运行时：

aws iam --region us-west-2 create-role --role-name ecsTaskExecutionRole --assume-role-policy-document task-execution-assume-role.json

我得到：

调用 CreateRole 操作时发生错误 (MalformedPolicyDocument)：此策略包含无效的 Json

我知道文件路径是正确的，因为如果它错了，我会得到一个不同的错误。起初我认为它是“无效的 json”，因为“sid”是一个空字符串，我删除了该属性并得到了同样的错误。

有人知道这里出了什么问题吗？

Answer 1

您需要指定assume-role-policy-documentas file://task-execution-assume-role.json。

从您链接的文档中

aws iam --region us-west-2 create-role --role-name ecsTaskExecutionRole --assume-role-policy-document file://task-execution-assume-role.json

由于缺少file://... ，cli 抛出的错误不是一个非常直观的错误

aws iam --region us-west-2 create-role \
--role-name ecsTaskExecutionRole \
--assume-role-policy-document task-execution-assume-role.json

An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: This policy contains invalid Json

添加file://后创建通过

aws iam --region us-west-2 create-role \
--role-name ecsTaskExecutionRole \
--assume-role-policy-document file://task-execution-assume-role.json
{
    "Role": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ecs-tasks.amazonaws.com"
                    }
                }
            ]
        },
        "RoleId": "AROA2ZHAP3GUV5UTOV5ZF",
        "CreateDate": "2019-07-31T23:15:04Z",
        "RoleName": "ecsTaskExecutionRole",
        "Path": "/",
        "Arn": "arn:aws:iam::*******:role/ecsTaskExecutionRole"
    }
}