aws lambda 函数和相应的 IAM 角色，用于在 CloudFormation 中停止和启动 EC2 实例

Question

I'm trying to launch a scheduled instance which will be stopped and start at a specified time in each day (in AWS CloudFormation template). it's my IAM role and policy that I defined for the lambda function:

RootRole: 
Type: 'AWS::IAM::Role'
Properties:
  AssumeRolePolicyDocument: 
    Version: 2012-10-17
    Statement:
    - Effect: Allow
      Action:
       - logs:CreateLogGroup  
       - logs:CreateLogStream
       - logs:PutLogEvents

      Resource: arn:aws:logs:*:*:*
    - Effect: Allow
      Action: 
      - ec2:Start*
      - ec2:Stop*
      Resource: "*"

when I create a stack, it return an error in the console(CREATE_FAILED) and the status reason is:

Has prohibited field Resource (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 3094b9eb-9f45-4763-8f21-9c3f2496fc52)

And after this error all the services related to this role are failed by this error:

The following resource(s) failed to create: [InternetGateway, SNSTopicNameCreate, LambdaInvocationsAlarm, RootRole, VPC, LambdaInvocationsAnomalyDetector]. . Rollback requested by user.

Answer 1

Your policy appears to be confusing the "Assume Role" section, which defines the Trust Policy, with the "Policy" section, which grants permissions to the IAM Role.

Try this:

AWSTemplateFormatVersion: 2010-09-09

Resources:
  LambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: Lambda-Role
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: AllowLogsAndEC2
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Resource: arn:aws:logs:*:*:*
              - Effect: Allow
                Action:
                - ec2:StartInstances
                - ec2:StopInstances
                Resource: "*"

Typically, the easiest way to create a policy is to copy an existing policy and make minor changes, or use the policy editor in the IAM console to generate most of what you want. You can then tweak the policy it provides.