如何调试云形成模板?策略中的语法错误.亚姆尔文件

Question

我在部署堆栈时遇到的错误：

Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 

这是我的角色策略，导致错误：

roleEc2:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: Allow
Principal:
Service:
- 'ec2.amazonaws.com'
Action:
- 'sts:AssumeRole'
Path: '/'
Policies:
-
PolicyName: 'bucket-access'
PolicyDocument:
Version: '2012-10-17'
Id: 'BucketPolicy'
Statement:
- Effect: Allow
Action:
- s3:ListBucket
- s3:GetObject
- s3:GetBucketLocation
Resource:
- arn:aws:s3:::code-dir
- arn:aws:s3:::code-dir/*
Principal: !Ref BucketPrincipal

而且我不知道如何调试它，我不知道如何理解错误在哪里，什么行号。

Answer 1

(我知道这是一年后，但仍然...我喜欢使用的一个好工具是 cfn-lint：https://github.com/aws-cloudformation/cfn-python-lint 针对您的模板运行它，它会向您显示您做错了什么，在哪一行：

代码中的问题：没有前四行，IAM 策略中不能有委托人(最后一行(。

---
AWSTemplateFormatVersion: '2010-09-09'
Description: AoD CloudFormation Template Detective Controls
Resources:
roleEc2:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
-
Effect: Allow
Principal:
Service:
- 'ec2.amazonaws.com'
Action:
- 'sts:AssumeRole'
Path: '/'
Policies:
-
PolicyName: 'bucket-access'
PolicyDocument:
Version: '2012-10-17'
Id: 'BucketPolicy'
Statement:
- Effect: Allow
Action:
- s3:ListBucket
- s3:GetObject
- s3:GetBucketLocation
Resource:
- arn:aws:s3:::code-dir
- arn:aws:s3:::code-dir/*