信任关系错误 AssumeRole 策略只能指定 STS AssumeRole 操作

Question

我正在尝试添加信任关系以允许 codedeploy 为我的角色工作

我有以下 json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": ["ec2.amazonaws.com", "codedeploy.amazonaws.com"]
      },
      "Action": ["sts:AssumeRole",
                "codedeploy:GetApplication",
                "codedeploy:GetDeploymentGroup",
                "codedeploy:CreateDeployment",
                "codedeploy:GetDeployment"      
      ]
    }
  ]
}

我不断收到以下错误

Answer 1

您在策略中混合了两个不同的概念：信任关系和 IAM 操作。

您需要有两种不同的策略，一种用于 IAM 角色，例如：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

IAM 政策的其他内容为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "codedeploy.amazonaws.com"
      },
      "Action": [
        "codedeploy:GetApplication",
        "codedeploy:GetDeploymentGroup",
        "codedeploy:CreateDeployment",
        "codedeploy:GetDeployment"
     ]
    }
  ]
}