CloudFormation部署IAM策略遇groupName无效错误求解决

AWS::IAM::Policy资源的Groups属性要求填入的是IAM组的名称，而非完整的ARN。你当前配置里把整个ARN填进去，系统会将其当作组名解析，其中包含的:、/属于非法字符，所以触发了验证错误。

根据你的场景选择对应的修改方式：

场景1：引用已存在的IAM组 #

直接填写组的名称即可，不需要ARN：

Description: ""

Metadata:
  Generator: former2

Resources:
  MyIAMPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: TestLogPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
          - Effect: Allow
            Action:
              - logs:CreateExportTask
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
      Groups:
        - createCloudFormationTest

场景2：在同一模板中创建IAM组并关联 #

如果需要在模板里创建组再绑定策略，用!Ref引用组的逻辑ID：

Description: ""

Metadata:
  Generator: former2

Resources:
  MyIAMGroup:
    Type: AWS::IAM::Group
    Properties:
      GroupName: createCloudFormationTest

  MyIAMPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: TestLogPolicy
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
          - Effect: Allow
            Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
          - Effect: Allow
            Action:
              - logs:CreateExportTask
            Resource: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:test_api-app-test:*"
      Groups:
        - !Ref MyIAMGroup

内容的提问来源于stack exchange，提问作者Masahiro Hanawa