Question

我试图通过CodeDeploy将代码发布到AWS上。为此，我必须创建一个角色，目前该角色一直停留在该角色上。我这样设置政策：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codedeploy.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

，并将文件另存为service-role.json。然后，我使用了命令：

aws iam create-role --role-name MyServiceRole --assume-role-policy-document file://service-role.json

我必须运行...最终。那返回了一些JSON：

{                                                                               
    "Role": {                                                                   
        "Path": "/",                                                            
        "RoleName": "MyServiceRole",                                
        "RoleId": "SOMESTRINGOFRANDOMALPHANUMERICS",                                      
        "Arn": "arn:aws:iam::1123445569:role/MyServiceRole",      
        "CreateDate": "2018-08-31T03:18:24Z",                                   
        "AssumeRolePolicyDocument": {                                           
            "Version": "2012-10-17",                                            
            "Statement": [                                                      
                {                                                               
                    "Sid": "",                                                  
                    "Effect": "Allow",                                          
                    "Principal": {                                              
                        "Service": [                                            
                            "codedeploy.amazonaws.com"                          
                        ]                                                       
                    },                                                          
                    "Action": "sts:AssumeRole"                                  
                }                                                               
            ]
        }
    }
}

这一切看起来都是正确的，所以我尝试运行：

aws iam attach-role-policy --role-name MyServiceRole --policy-arn arn:aws:iam::1123445569:role/MyServiceRole

然后...我得到了答复

An error occurred (InvalidInput) when calling the AttachRolePolicy operation: ARN arn:aws:iam::1123445569:role/MyServiceRole is not valid.

我已经在互联网上寻找解决方案，因为看来this完全按照我的指示进行了操作，但仍然没有结果。有人知道我在做什么错吗？

Answer 1

不要附加您已创建的假设角色策略（创建时已附加到 MyServiceRole ），而是附加mentioned tutorial中描述的AWS特权角色之一（步骤3），所以：

aws iam attach-role-policy --role-name MyServiceRole --policy-arn arn:aws:iam::aws:policy/service-role/AWSCodeDeployRole

或

aws iam attach-role-policy --role-name MyServiceRole --policy-arn arn:aws:iam::aws:policy/service-role/AWSCodeDeployRoleForLambda

由于无效信息

1 个答案: