如何通过 CloudFormation 添加 AWS 托管策略

Question

我想使用 CloudFormation 将 AWS 托管策略 (AmazonSSMFullAccess) 添加到角色。 我尝试使用 AWS::IAM::ManagedPolicy，但它创建了一个客户管理的策略，我不希望这样。我希望它由 AWS 托管。 你知道我该怎么做吗？

我正在尝试添加 AWS 托管的 AmazonSSMFullAccess，这是我在 mu CF 模板中使用的代码：

AmazonSSMFullAccess:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - 'cloudwatch:PutMetricData'
              - 'ds:CreateComputer'
              - 'ds:DescribeDirectories'
              - 'ec2:DescribeInstanceStatus'
              - 'logs:*'
              - 'ssm:*'
              - 'ec2messages:*'
            Resource: '*'
          - Effect: Allow
            Action: 'iam:CreateServiceLinkedRole'
            Resource: >-
              arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*
            Condition:
              StringLike:
                'iam:AWSServiceName': ssm.amazonaws.com
          - Effect: Allow
            Action:
              - 'iam:DeleteServiceLinkedRole'
              - 'iam:GetServiceLinkedRoleDeletionStatus'
            Resource: >-
              arn:aws:iam::*:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM*
          - Effect: Allow
            Action:
              - 'ssmmessages:CreateControlChannel'
              - 'ssmmessages:CreateDataChannel'
              - 'ssmmessages:OpenControlChannel'
              - 'ssmmessages:OpenDataChannel'
            Resource: '*'

Answer 1

您无法创建 AWS 托管策略，因为只有 AWS 可以创建。作为 AWS 客户，您只能创建客户托管策略。