无法使用 cloudformation 仅创建 IAM 策略

Question

我在 cloudformation.But 中创建 IAM 策略时遇到问题，当我 运行 时收到错误消息，需要组、角色、用户：

这是我的代码：

{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "AWS CloudFormation Template IAM Groups and Policies",
"Resources": {
    "PolicyAutoScalingLimitedOperation": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyName": "AutoScaling-Limited-Operation",
            "PolicyDocument": {
                "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "dynamodb:*"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "cloudwatch:PutMetricData"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "xray:PutTraceSegments",
                            "xray:PutTelemetryRecords"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "s3:Get*",
                            "s3:List*",
                            "s3:PutObject"
                        ],
                        "Resource": "*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "logs:PutLogEvents",
                            "logs:CreateLogStream"
                        ],
                        "Resource": "arn:aws:logs:*:*:log-group:/aws/elasticbeanstalk*"
                    },
                    {
                        "Effect": "Allow",
                        "Action": [
                            "kms:ListAliases",
                            "kms:ListKeys",
                            "kms:Encrypt",
                            "kms:Decrypt"
                        ],
                        "Resource": "*"
                    }
                ]
            }
        }
    }
}

}

现在当我 运行 它时我得到：

At least one of [Groups,Roles,Users] must be non-empty.

这是否意味着我不能在不添加 user/role 的情况下使用 cloudformation 创建策略？

Answer 1

如果您只想要一个独立的策略，您可能想要创建一个 AWS::IAM::ManagedPolicy。

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html

Answer 2

来自documentation：

AWS::IAM::ManagedPolicy creates an AWS Identity and Access Management (IAM) managed policy for your AWS account, which you can use to apply permissions to IAM users, groups, and roles.

这是一个例子：

Resources:
  CreateTestDBPolicy: 
    Type: AWS::IAM::ManagedPolicy
    Properties: 
      Description: "Policy for creating a test database"
      Path: "/"
      PolicyDocument: 
      Version: "2012-10-17"
      Statement: 
        - 
          Effect: "Allow"
          Action: "rds:CreateDBInstance"
          Resource: "*"

这将解决您的问题。