添加Transform:AWS::Include到CloudFormation模板时角色无效或无法假定

核心问题分析 #

你碰到的Role is invalid or cannot be assumed错误仅在使用AWS::Include Transform时触发，根源集中在以下三个方面：

1. 信任策略条件过严 #

你的CloudformationDeploymentRole信任策略仅限制了aws:SourceAccount，缺少aws:SourceArn匹配条件。当CloudFormation调用AWS::Include Transform时，请求的来源ARN无法通过当前条件校验，导致无法成功假设角色。

2. 重复定义托管策略 #

模板中存在两个同名的CloudformationDeployPolicy托管策略，CloudFormation会自动覆盖第一个策略，导致原本包含的DMS、IAM核心权限丢失，角色权限不全无法完成Transform操作。

3. Transform调用权限缺失 #

第二个策略仅授权了cloudformation:CreateChangeSet针对Transform资源，但调用AWS::Include还需要cloudformation:Invoke权限，否则无法触发Transform执行。

修复步骤 #

1. 调整角色信任策略 #

更新信任策略，添加aws:SourceArn条件，确保CloudFormation服务能正常假设角色：

CloudformationDeploymentRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: cloudformation-deployment-role
    Path: /
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
      - Effect: Allow
        Principal:
          Service: cloudformation.amazonaws.com
        Action: sts:AssumeRole
        Condition:
          StringEquals:
            aws:SourceAccount: !Ref AWS::AccountId
          ArnLike:
            aws:SourceArn: !Sub arn:aws:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/*/*

2. 合并重复的托管策略 #

将两个CloudformationDeployPolicy合并为一个，避免权限丢失，同时补充cloudformation:Invoke权限：

CloudformationDeployPolicy:
  Type: AWS::IAM::ManagedPolicy
  Properties:
    Path: /
    ManagedPolicyName: cloudformation-deploy-policy
    Roles:
    - !Ref CloudformationDeploymentRole
    PolicyDocument:
      Version: 2012-10-17
      Statement:
      # 保留原有的IAM权限
      - Effect: Allow
        Action:
          - iam:*Policy*
          - iam:CreateRole
          - iam:GetRole
          - iam:TagRole
          - iam:UntagRole
        Resource: !Sub arn:aws:iam::${AWS::AccountId}:role/dms-vpc-role
      # 保留原有的通用 wildcard 权限
      - Sid: WildcardActions
        Action:
          - ec2:DeleteTags
          - secretsmanager:GetRandomPassword
          - secretsmanager:CreateSecret
          - rds:DescribeEngineDefaultParameters
        Effect: Allow
        Resource: "*"
      # 保留原有的DMS权限
      - Sid: DMS
        Action:
          - dms:*ReplicationSubnetGroup
          - dms:AddTagsToResource
          - dms:*Endpoint
          - dms:CreateReplicationInstance
          - dms:DescribeReplicationInstances
          - dms:*ReplicationTask*
          - dms:ListTagsForResource
        Effect: Allow
        Resource: !Sub arn:aws:dms:${AWS::Region}:${AWS::AccountId}:*:*
      # 补充Transform调用权限
      - Sid: UpdateCfn
        Action:
          - cloudformation:CreateChangeSet
          - cloudformation:Invoke
        Effect: Allow
        Resource: !Sub arn:aws:cloudformation:${AWS::Region}:aws:transform/Include
      # 保留原有的SSM权限
      - Sid: SsmParamPermissions
        Effect: Allow
        Action:
          - ssm:GetParameter*
          - ssm:PutParameter
          - ssm:DeleteParameter
          - ssm:AddTagsToResource
          - ssm:RemoveTagsFromResource
        Resource: !Sub arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/*
      # 保留原有的VPC权限
      - Sid: VpcPermissions
        Effect: Allow
        Action:
          - ec2:CreateSecurityGroup
          - ec2:DeleteSecurityGroup
          - ec2:AuthorizeSecurityGroup*
          - ec2:CreateTags
          - ec2:DescribeVpcs
          - ec2:DescribeSubnets
          - ec2:DescribeSecurityGroups
          - ec2:DescribeAvailabilityZones
        Resource: '*'

3. 验证S3权限匹配 #

确认DevOpsArtifactsPolicy中的ArtifactsBucketName和AWS::Include里使用的BucketName是同一个参数，确保角色有权限读取目标S3文件。

额外检查项 #

• 若S3桶启用KMS加密，需确认对应KMS密钥策略允许该角色执行解密操作
• 检查S3桶策略，确保明确允许cloudformation-deployment-role读取dms/table-mappings.json文件

内容的提问来源于stack exchange，提问作者Shanika Ediriweera