Error: "Conditions must be prefaced by a vendor." on creating Role in AWS CDK

Question

我在尝试使用 AWS CDK 创建新角色时收到 "Conditions must be prefaced by a vendor." 错误。

export const configureIAMRole = (scope: Construct) => {
  const roleAction = 'sts:AssumeRoleWithWebIdentity';
  const iamRole = new Role(scope, 'IAMRole', {
    assumedBy: new FederatedPrincipal(
      'cognito-identity.amazonaws.com',
      {
        StringEquals: { 'cognito-identity.amazonaws.com': identityPool.ref },
        'ForAnyValue:StringLike': { 'cognito-identity.amazonaws.com:amr': 'authenticated' },
      },
      roleAction
    ),
  });
  return iamRole;
};

我尝试按照文档 here 添加供应商前缀，例如"aws:StringEquals"。这导致了其他错误，例如无效的语法。

目的是使用 Cognito 进行身份验证：用户和密码，以及联合身份，例如google。提前感谢您的提示。

Answer 1

这是一个带有身份池的 iam 角色应用示例：

https://github.com/cloudshiftstrategies/aws-cdk-examples/blob/master/iam-role-typescript-app

您似乎忘记将 :aud 添加到 StringEquals 中 'cognito-identity.amazonaws.com' 的末尾。应该是

'cognito-identity.amazonaws.com:aud': identityPool.ref

Error: "Conditions must be prefaced by a vendor." on creating Role in AWS CDK

Error: "Conditions must be prefaced by a vendor." on creating Role in AWS CDK

amazon-web-services

amazon-cloudformation

aws-cdk