添加SQS权限后CloudFormation策略报错：PolicyDocument必须为对象

错误根源 #

报错Value of property PolicyDocument must be an object的核心原因是：IAM策略文档（PolicyDocument）必须是包含Version和Statement字段的对象，你直接将权限语句数组放在了PolicyDocument下，不符合CloudFormation的结构要求。这和你误以为的账号ID变量无关，只是添加新规则后触发了结构校验。

修复步骤 #

1. 给PolicyDocument添加Version字段（固定使用2012-10-17，这是IAM策略的标准版本）
2. 将所有权限语句包裹到Statement数组中
3. 替换SQS资源里的固定账号ID为CloudFormation内置变量!Sub ${AWS::AccountId}；如果队列区域需要和部署区域一致，也可以将us-east-1替换为!Sub ${AWS::Region}（固定区域则保留原值）

修复后的完整代码 #

Policies:
    - PolicyName: !Sub 'X-${AWS::Region}'
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: 'ssm:GetParametersByPath'
            Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X'
          - Effect: Allow
            Action: 'ssm:GetParameters'
            Resource: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/X/*'
          - Effect: Allow
            Action: 's3:*'
            Resource: '*'
          - Effect: Allow
            Action:
              - secretsmanager:GetSecretValue
            Resource:
              - !Sub 'arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:C*'

          - Effect: Allow
            Action:
              - 'ec2:DescribeNetworkInterfaces'
              - 'ec2:CreateNetworkInterface'
              - 'ec2:DeleteNetworkInterface'
              - 'ec2:DescribeInstances'
              - 'ec2:AttachNetworkInterface'
            Resource: '*'
          - Effect: Allow
            Action: 'kms:Decrypt'
            Resource: '*'
          - Effect: Allow
            Action: sqs:*
            Resource: !Sub 'arn:aws:sqs:us-east-1:${AWS::AccountId}:Q.fifo'

    RoleName: !Sub 'X-${AWS::Region}'

额外说明 #

• 若需要SQS队列区域与CloudFormation栈部署区域保持一致，可将资源中的us-east-1替换为!Sub ${AWS::Region}
• 所有IAM策略文档都必须遵循Version + Statement的结构，这是AWS的强制规范，之前未报错属于宽松校验下的特例，结构本身并不合法

内容的提问来源于stack exchange，提问作者Micah Armantrout