- CodeBuild项目
- CodePipeline管道
- 所需角色
我使用了一个托管策略创建了该角色,但我已经尝试了一个普通策略,但它也不起作用。arn:aws:iam::ACCOUNT_ID:role/CodePipelineRole未被授权对角色arn:aws:iam::ACCOUNT_ID:role/CodePipelineRole执行AssumeRole操作(服务:AWSCodePipeline;状态码:400;错误代码:InvalidStructureException;请求ID:7de2b1c6-a432-47e6-8208-2c0072ebaf4b)
这是角色策略:
CodePipelinePolicy:
Type: AWS::IAM::ManagedPolicy
Properties:
Description: 'This policy grants permissions to a service role to enable Codepipeline to use multiple AWS Resources on the users behalf'
Path: "/"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Resource: "*"
Effect: "Allow"
Condition: {}
Action:
- autoscaling:*
- cloudwatch:*
- cloudtrail:*
- cloudformation:*
- codebuild:*
- codecommit:*
- codedeploy:*
- codepipeline:*
- ec2:*
- ecs:*
- ecr:*
- elasticbeanstalk:*
- elasticloadbalancing:*
- iam:*
- lambda:*
- logs:*
- rds:*
- s3:*
- sns:*
- ssm:*
- sqs:*
- kms:*
这是角色CodePipelineRole:
Type: "AWS::IAM::Role"
Properties:
RoleName: !Sub ${EnvironmentName}-CodePipelineRole
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Action:
- 'sts:AssumeRole'
Effect: Allow
Principal:
Service:
- codepipeline.amazonaws.com
Path: /
ManagedPolicyArns:
- !Ref CodePipelinePolicy
最让我感兴趣的是,似乎CodePipelineRole试图对自己进行AssumeRole。我不明白这里可能发生了什么。
当我将策略的操作设置为*时,它可以正常工作!我不知道缺少哪些权限。
谢谢