AWS CodePipeline CloudFormation部署失败：IAM权限配置异常求助

我有一条AWS CodePipeline，最后一步用于部署CDK模板，使用的IAM角色为 arn:aws:iam::975050149793:role/CodePipelineBuildAndDeployRoleV2。

该角色的权限策略如下：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ecr:GetAuthorizationToken",
                "s3:List*"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "s3:Abort*",
                "s3:DeleteObject*",
                "s3:GetBucket*",
                "s3:GetObject*",
                "s3:List*",
                "s3:ListBucket",
                "s3:PutObject",
                "s3:PutObjectLegalHold",
                "s3:PutObjectRetention",
                "s3:PutObjectTagging",
                "s3:PutObjectVersionTagging"
            ],
            "Resource": [
                "arn:aws:s3:::code-pipeline-artifact-bucket-v2",
                "arn:aws:s3:::code-pipeline-artifact-bucket-v2/*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": [
                "ecr:BatchCheckLayerAvailability",
                "ecr:BatchGetImage",
                "ecr:CompleteLayerUpload",
                "ecr:GetDownloadUrlForLayer",
                "ecr:InitiateLayerUpload",
                "ecr:PutImage",
                "ecr:UploadLayerPart"
            ],
            "Resource": "arn:aws:ecr:us-east-1:975050149793:repository/hello-world-ecr-repository-from-cdk",
            "Effect": "Allow"
        },
        {
            "Action": "sts:AssumeRole",
            "Resource": [
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackBuildcdkcodesynthesi-vFR745UypNHH",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackBuildlambdadockerima-bwgUOKwVvSkx",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackSourceCDKGitHubSourc-2ucigcXrrb9y",
                "arn:aws:iam::975050149793:role/CodePipelineStack-PipelineStackSourceLambdaGitHubSo-wCf42p9m8VdL",
                "arn:aws:iam::975050149793:role/CodePipelineBuildAndDeployRoleV2"
            ],
            "Effect": "Allow"
        },
        {
            "Action": "iam:PassRole",
            "Resource": "arn:aws:iam::975050149793:role/CodePipelineBuildAndDeployRoleV2",
            "Effect": "Allow"
        },
        {
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:DescribeStack*",
                "cloudformation:GetStackPolicy",
                "cloudformation:GetTemplate*",
                "cloudformation:SetStackPolicy",
                "cloudformation:UpdateStack",
                "cloudformation:ValidateTemplate"
            ],
            "Resource": "arn:aws:cloudformation:us-east-1:975050149793:stack/LambdaStackDeployedName/*",
            "Effect": "Allow"
        }
    ]
}

信任策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "codepipeline.amazonaws.com",
                    "s3.amazonaws.com",
                    "codebuild.amazonaws.com"
                ]
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

部署持续失败，报错信息：

User: arn:aws:sts::975050149793:assumed-role/CodePipelineBuildAndDeployRoleV2/1727290405840 is not authorized to perform: s3:ListBucket on resource: "arn:aws:s3:::code-pipeline-artifact-bucket-v2" because no session policy allows the s3:ListBucket action (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: QDFVFYCJQ08K3AGJ; S3 Extended Request ID: sDxvgKj+HGpAMXO2Y7SAkBysTM0490KbWkHFjNX9ozwp6JoMSjEguvwh/3I97i2LA4oYD1W4Nj4=; Proxy: null)

我已确认IAM策略包含必要权限，但仍报错，求解决方案。

1. 排查会话策略（Session Policy） #

报错明确提到「no session policy allows the s3:ListBucket action」，说明角色被Assume时附带了会话策略，限制了该权限：

• 打开CloudTrail，搜索该角色的AssumeRole事件，查看请求参数中是否包含Policy字段——这个字段就是会话策略，会进一步缩小角色的权限范围。
• 如果发现会话策略中未允许s3:ListBucket，需要调整Assume该角色的服务（比如CodePipeline、CodeBuild）的配置，移除或修改会话策略。

2. 检查权限边界（Permission Boundary） #

如果该角色设置了权限边界，即使角色本身的策略允许操作，边界未授权的话也会被拒绝：

• 进入IAM控制台，找到该角色，查看「权限边界」部分。
• 确认边界策略中包含允许s3:ListBucket针对arn:aws:s3:::code-pipeline-artifact-bucket-v2的权限。

3. 验证S3桶策略 #

S3桶本身的策略可能会覆盖角色权限：

• 进入S3控制台，找到code-pipeline-artifact-bucket-v2，查看「权限」-「桶策略」。
• 确保桶策略中没有拒绝该角色执行s3:ListBucket的语句，同时如果有允许语句，要确保优先级正确（拒绝语句优先级高于允许）。

4. 检查CDK部署的角色传递逻辑 #

CDK部署时可能会使用该角色去Assume其他执行角色，或者在CDK代码中限制了权限：

• 查看CDK代码中的部署配置，确认是否指定了role或sessionPolicy参数，是否无意中限制了S3权限。
• 检查CloudFormation执行角色（如果CDK使用了单独的执行角色），确认其权限是否包含所需的S3操作。

5. 验证IAM策略生效与语法 #

• 等待5-10分钟，确保IAM策略更新已生效（IAM策略变更有时会有延迟）。
• 使用IAM Access Analyzer验证该角色的权限策略，检查是否存在语法错误或逻辑冲突。
• 用AWS CLI模拟权限验证：

  aws iam simulate-principal-policy \
    --policy-source-arn arn:aws:iam::975050149793:role/CodePipelineBuildAndDeployRoleV2 \
    --action-names s3:ListBucket \
    --resource-arns arn:aws:s3:::code-pipeline-artifact-bucket-v2
  

  查看返回结果中的EvalDecision是否为allowed。

内容的提问来源于stack exchange，提问作者219CID