云形成新角色/策略 |格式不正确的策略文档

Question

我正在尝试使用云形成创建新角色和策略。

部署它时，我收到以下错误：

策略中的语法错误。(服务：亚马逊身份管理;状态代码：400;错误代码：格式错误的策略文档;请求 ID： 848a408e-b0f1-11e8-90b6-cf2a19d18ad2(

AWSTemplateFormatVersion: 2010-09-09
Description: >
AWS CloudFormation Template
Parameters:
StackName:
Type: String
Description: stack test
Default: stackTest
DclEnvironment:
Type: String
Description: Env
AllowedValues :
- test
- dev
- stage
- prod
Default: dev
Domain:
Type: String
Description: Private Domain name
Default: int.mydomain.com
VpcId:
Type: AWS::EC2::VPC::Id
Default: xxxx
AppAmiId:
Type: AWS::EC2::Image::Id
Description: Ec2 AMI ID
Default: ami-XXXX
KeyName:
Type: AWS::EC2::KeyPair::KeyName
Description: Key Name
Default: xxxx
SecurityGroupIds:
Type: CommaDelimitedList
Description: Comma-separated list of existing security group IDs in your VPC
Default: sg-xxxx
SubnetA:
Description: Subnet from AZ a
Type: String
Default: subnet-xxxxx
SubnetB:
Description: Subnet from AZ b
Type: String
Default: subnet-xxxx
SubnetC:
Description: Subnet from AZ c
Type: String
Default: subnet-xxxx
DbSubnetGroupA:
Type: String
Description: Subnet from AZ A
Default: subnet-xxxx
DbSubnetGroupB:
Type: String
Description: Subnet from AZ B
Default: subnet-xxxxx
DbSubnetGroupC:
Type: String
Description: Subnet from AZ C
Default: subnet-xxxxx
Resources:
monitoringRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join
- "-"
- - !Ref DclEnvironment
- "iam-01"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service:
- ec2.amazonaws.com
Path: "/"
policyEC2Monitoring:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Join
- "-"
- - !Ref DclEnvironment
- "policy-01"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:Describe*
Ressource: "*"
- Effect: Allow
Action:
- elasticloadbalancing:Describe*
Ressource: "*"
- Effect: Allow
Action:
- cloudwatch:ListMetrics*
- cloudwatch:GetMetricStatistics
- cloudwatch:Describe*
Ressource: "*"
- Effect: Allow
Action:
- autoscaling:Describe*
Ressource: "*"
Roles:
- !Ref monitoringRole
instanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
InstanceProfileName: !Join
- "-"
- - !Ref DclEnvironment
- "inp-01"
Path: "/"
Roles:
- !Ref monitoringRole

提前感谢，

Fas3r.

编辑

如果超过 1 个操作，资源应用 [ "*" ] 包围; 如果一个操作，则无需添加新行，可以是： 操作 ： 操作名称

BR.

Answer 1

正如错误所暗示的那样，您的 yaml 语法无效。

您可以使用 http://www.yamllint.com/等 Web 工具来排查语法问题。

下面是正确的语法 yaml 文件：

AWSTemplateFormatVersion: 2010-09-09
Description: >
AWS CloudFormation Template
Parameters:
StackName:
Type: String
Description: stack test
Default: stackTest
DclEnvironment:
Type: String
Description: Env
AllowedValues :
- test
- dev
- stage
- sbox
- prod
Default: dev
DclPod:
Type: String
Description: Pod Name
Default: enel
DclService:
Type: String
Description: Pod Name
Default: monitoring
Domain:
Type: String
Description: Private Domain name
Default: int.mydomain.com
VpcId:
Type: AWS::EC2::VPC::Id
Default: vpc-4ac3bb21
AppAmiId:
Type: AWS::EC2::Image::Id
Description: Ec2 AMI ID
Default: ami-XXXX
KeyName:
Type: AWS::EC2::KeyPair::KeyName
Description: Key Name
Default: c3-kp-01
SecurityGroupIds:
Type: CommaDelimitedList
Description: Comma-separated list of existing security group IDs in your VPC
Default: sg-07f5186b
SubnetA:
Description: Subnet from AZ a
Type: String
Default: subnet-7d576316
SubnetB:
Description: Subnet from AZ b
Type: String
Default: subnet-496a0834
SubnetC:
Description: Subnet from AZ c
Type: String
Default: subnet-7d576316
DbSubnetGroupA:
Type: String
Description: Subnet from AZ A
Default: subnet-1154607a
DbSubnetGroupB:
Type: String
Description: Subnet from AZ B
Default: subnet-3d650740
DbSubnetGroupC:
Type: String
Description: Subnet from AZ C
Default: subnet-4d027e00
Resources:
monitoringRole:
Type: AWS::IAM::Role
Properties:
RoleName: !Join
- "-"
- - !Ref DclEnvironment
- !Ref DclPod
- !Ref DclService
- "iam-01"
AssumeRolePolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action: sts:AssumeRole
Principal:
Service:
- ec2.amazonaws.com
Path: "/"
policyEC2Monitoring:
Type: AWS::IAM::Policy
Properties:
PolicyName: !Join
- "-"
- - !Ref DclEnvironment
- !Ref DclPod
- !Ref DclService
- "policy-01"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: Allow
Action:
- ec2:Describe*
Ressource: "*"
- Effect: Allow
Action:
- elasticloadbalancing:Describe*
Ressource: "*"
- Effect: Allow
Action:
- cloudwatch:ListMetrics*
- cloudwatch:GetMetricStatistics
- cloudwatch:Describe*
Ressource: "*"
- Effect: Allow
Action:
- autoscaling:Describe*
Ressource: "*"
Roles:
- !Ref monitoringRole
instanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
InstanceProfileName: !Join
- "-"
- - !Ref DclEnvironment
- !Ref DclPod
- !Ref DclService
- "inp-01"
Path: "/"
Roles:
- !Ref monitoringRole

希望对您有所帮助。