无服务器框架错误策略语句必须包含操作

Question

我有一个IAM策略无法使用无服务器框架进行部署。错误消息是（服务：AmazonIdentityManagement;状态代码：400;错误代码：MalformedPolicyDocument;）。该政策如下：

DtcServiceFunctionRole:
Type: AWS::IAM::Role
Properties:
  Path: "/"
  RoleName: DtcServiceFunctionRole
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - lambda.amazonaws.com
        Action: sts:AssumeRole
  Policies:
    - PolicyName: dtc-invoke-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - "arn:aws:lambda:us-east-1:xxxxxxxxxxxxx:function:NotificationServiceFunction"
    - PolicyName: dtc-dynamodb-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
            - "dynamodb:BatchGetItem"
            - "dynamodb:BatchWriteItem"
            - "dynamodb:DeleteItem"
            - "dynamodb:GetItem"
            - "dynamodb:PutItem"
            - "dynamodb:Query"
            - "dynamodb:Scan"
            - "dynamodb:UpdateItem"
            Resource:
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/VehicleDtcTable"
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/DtcTable"
          - Effect: Allow

任何帮助指出我正确的方向是值得赞赏的。谢谢。

Answer 1

看起来你的yaml没有正确缩进：

        Statement:
      - Effect: Allow
        Action:
        - "dynamodb:BatchGetItem"
        - "dynamodb:BatchWriteItem"
        - "dynamodb:DeleteItem"
        - "dynamodb:GetItem"
        - "dynamodb:PutItem"
        - "dynamodb:Query"
        - "dynamodb:Scan"
        - "dynamodb:UpdateItem"

它应该是：

DtcServiceFunctionRole:
Type: AWS::IAM::Role
Properties:
  Path: "/"
  RoleName: DtcServiceFunctionRole
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - lambda.amazonaws.com
        Action: sts:AssumeRole
  Policies:
    - PolicyName: dtc-invoke-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "lambda:InvokeFunction"
            Resource:
              - "arn:aws:lambda:us-east-1:xxxxxxxxxxxxx:function:NotificationServiceFunction"
    - PolicyName: dtc-dynamodb-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - "dynamodb:BatchGetItem"
              - "dynamodb:BatchWriteItem"
              - "dynamodb:DeleteItem"
              - "dynamodb:GetItem"
              - "dynamodb:PutItem"
              - "dynamodb:Query"
              - "dynamodb:Scan"
              - "dynamodb:UpdateItem"
            Resource:
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/VehicleDtcTable"
              - "arn:aws:dynamodb:us-east-1:xxxxxxxxxxxxx:table/DtcTable"
          - Effect: Allow