CloudFormation 聲稱 KMS 策略聲明主體無效

Question

我有以下 SAM 模板：

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  test lambda
Globals:
  Function:
    Timeout: 3
    Tracing: Active
  Api:
    TracingEnabled: True

Resources:
  NotesFunction:
    Type: AWS::Serverless::Function
    Properties:
      PackageType: Zip
      CodeUri: notes/
      Handler: app.lambdaHandler
      Runtime: nodejs18.x
      Policies:
      - AmazonDynamoDBFullAccess
      Architectures:
        - x86_64
      Events:
        FetchNotes:
          Type: Api
          Properties:
            Path: /notes
            Method: get
        GiveNotes:
          Type: Api
          Properties:
            Path: /notes
            Method: post
        Users:
          Type: Api
          Properties:
            Path: /notes/users
            Method: get
    Metadata:
      BuildMethod: esbuild
      BuildProperties:
        Minify: true
        Target: "es2020"
        Sourcemap: true
        EntryPoints:
        - app.ts

  KmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: CMK for encrypting and decrypting
      KeyPolicy:
        Version: '2012-10-17'
        Id: key-default-1
        Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
          Action: kms:*
          Resource: '*'
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: arn:aws:iam::<MY_ACCOUNT>:role/aws-service-role/cks.kms.amazonaws.com/KMSKeyAdminRole
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion
          Resource: '*'
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            AWS: !Ref NotesFunctionRole
          Action:
          - kms:DescribeKey
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt*
          - kms:GenerateDataKey
          - kms:GenerateDataKeyWithoutPlaintext
          Resource: '*'

  NotesDynamoDB:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: experimental-notes
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      StreamSpecification:
        StreamViewType: NEW_IMAGE

Outputs:
  NotesApi:
    Description: "API Gateway endpoint URL for dev stage for Notes function"
    Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/dev/notes/"
  NotesFunction:
    Description: "Notes Lambda Function ARN"
    Value: !GetAtt NotesFunction.Arn
  NotesFunctionIamRole:
    Description: "Implicit IAM Role created for Notes function"
    Value: !GetAtt NotesFunctionRole.Arn
  NotesDynamoDB:
    Description: "DynamoDB table backing the Lambda"
    Value: !GetAtt NotesDynamoDB.Arn

當我構建 + 部署此模板時，出現以下 CloudFormation 錯誤：

Resource handler returned message: "Policy contains a statement with one or more invalid principals....

顯然我已經編輯了我的實際帳戶 ID 並將其替換為<MY_ACCOUNT> (.)。

但它並沒有說明哪些委托人是“無效”的。 這個想法是第二個策略聲明被應用/硬編碼到現有角色（ KMSKeyAdminRole ）。 第三條語句應用於上面創建的NotesFunction Lambda 的角色。

誰能發現我哪里出錯了？

Answer 1

這最終完美地工作並修復了 CF 錯誤：

- Sid: Allow use of the key
  Effect: Allow
  Principal:
    AWS: !GetAtt FeedbackFunctionRole.Arn
  Action:
  - kms:DescribeKey
  - kms:Encrypt
  - kms:Decrypt
  - kms:ReEncrypt*
  - kms:GenerateDataKey
  - kms:GenerateDataKeyWithoutPlaintext
  Resource: '*'

Answer 2

使用此https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html測試您的政策是否有效