在 AWS 中为 OIDC 提供商的角色添加策略时出错

Question

I have created a OIDC provider for Firebase from AWS console. Next, to create a Role for this OIDC provider, as described in AWS docs here , (don't know who writes/maintains such never helpful docs) I am trying to create a trust policy like below:

{
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "RoleForLoginFirebaseOIDC",
        "Effect": "Allow",
        "Principal": {"Federated": "arn:aws:iam::100110001110:oidc-provider/securetoken.google.com/firebaseProjectId"},
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
            "StringEquals": {"securetoken.google.com:aud": "firebaseProjectId"},
            "ForAnyValue:StringLike": {"cognito-identity.amazonaws.com:amr": "unauthenticated"}
        }
    }]
}

However, getting below 2 errors:

• Ln 3, Col 18 Missing Resource: Add a Resource or NotResource element to the policy statement.

• Ln 6, Col 21 Unsupported Principal: The policy type IDENTITY_POLICY does not support the Principal element. Remove the Principal element.

Answer 1

looks like its a issue when adding from AWS console, adding the rule and its policy using AWS CLI works with no issues - follow https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp.html to add rule/policy using CLI