使用托管策略和内联策略创建角色时出现云形成错误

Question

When i run this stack, i am receiving the below error. Trying for the first time with the help of AWS documents, But still could not figure the error.

By this CFT, i am trying to create a role with managed policy and attach a inline policy to it

Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument

But could not figure out where the syntax is missing, Can someone help me here.

    "EMRDefaultRole": {
        "Type": "AWS::IAM::Role",
        "Properties": {
            "RoleName": "EMR_DefaultRole",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [ {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "elasticmapreduce.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                } ]
            },
            "ManagedPolicyArns": [
                "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceRole"
            ]
        }
    },
    "EMRS3Policies": {
        "Type": "AWS::IAM::Policy",
        "Properties": {
            "PolicyName": "Moodys-IAM-EMR-S3-Access-Policy",
            "PolicyDocument": {
                    "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "s3:HeadBucket",
                            "s3:ListObjects"
                        ],
                        "Resource": {["Fn::Join",[
                                "-",
                                [
                                    "mit",
                                    {
                                        "Ref": "AWS::AccountId"
                                    }
                                    "emr-files/*"
                                ]]
                                ]}
                    }]
            },
        "Roles": [{"Ref": "EMRDefaultRole"}]

Answer 1

There is a problem in the Resource key, you are incorrectly using Fn::Join . It should be:

{
  "Resource": {
    "Fn::Join": [
      "",
      [
        "arn:aws:s3:::mit-",
        { "Ref": "AWS::AccountId" },
        "-emr-files/*"
      ]
    ]
  }
}