获取服务：AmazonIdentityManagement；状态码：400；错误代码：创建 Cloudformation 堆栈时的 MalformedPolicyDocument

Question

我正在尝试为 ECR 和 ELB 创建云形成模板，我将我的图像分别推送到 ECR。在 Dockerrun.json 中，我这样引用我的图像“图像”：“.dkr.ecr.ap-south-1.amazonaws.com/*:latest”。所以我需要为 ELB 和 ECR 提供 IAM 权限。但是此模板中的 IAM 部分存在一些问题。创建堆栈时出现此错误。是否需要任何修复？

Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 8b9b3f05-51c9-41e1-b008-c59aa319c086; Proxy: null)

Resources:
  sampleApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: AWS Elastic Beanstalk Sample Application
  sampleApplicationVersion:
    Type: AWS::ElasticBeanstalk::ApplicationVersion
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Application Version
      SourceBundle:
        S3Bucket: !Sub "elasticbeanstalk-ap-south-1-182107200133"
        S3Key: TravelTouch/Dockerrun.aws.json
  MyRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "182107200133.dkr.ecr.ap-south-1.amazonaws.com/socialbox"
  sampleConfigurationTemplate:
    Type: AWS::ElasticBeanstalk::ConfigurationTemplate
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Configuration Template
      OptionSettings:
        - Namespace: aws:autoscaling:asg
          OptionName: MinSize
          Value: '2'
        - Namespace: aws:autoscaling:asg
          OptionName: MaxSize
          Value: '6'
        - Namespace: aws:elasticbeanstalk:environment
          OptionName: EnvironmentType
          Value: LoadBalanced
        - Namespace: aws:autoscaling:launchconfiguration
          OptionName: IamInstanceProfile
          Value: !Ref MyInstanceProfile
      SolutionStackName: 64bit Amazon Linux 2018.03 v2.26.0 running Multi-container Docker 19.03.13-ce (Generic)

  sampleEnvironment:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Environment
      TemplateName:
        Ref: sampleConfigurationTemplate
      VersionLabel:
        Ref: sampleApplicationVersion

  MyInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Beanstalk EC2 role
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
      Policies:
        - PolicyName: AllowGetAuthorizationToken
          PolicyDocument: |
            {
              "Version": "2012-10-17",
              "Statement": [
                  {
                      "Sid": "ECSAccess",
                      "Effect": "Allow",
                      "Action": [
                          "ecr:GetAuthorizationToken",
                      ],
                      "Resource": "*"
                  }
              ]
            }  

  MyInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref MyInstanceRole

Answer 1

错误的地方有,。而不是：

"ecr:GetAuthorizationToken",

应该是（没有逗号）：

"ecr:GetAuthorizationToken"