CloudFormation配置IAM角色信任策略时Resource字段报错的解决方法

我想用CloudFormation的YAML模板创建一个S3存储桶，以及一个允许transfer.amazonaws.com服务访问该桶的IAM角色，原模板如下：

Resources:
  S3SFTPBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub ${Env}-sftp-${AWS::AccountId}
      PublicAccessBlockConfiguration: 
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  SFTPIAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${Env}-sftp-${AWS::AccountId}-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "transfer.amazonaws.com"
            Action:
              - "sts:AssumeRole"
            Resource:
            - !GetAtt S3SFTPBucket.Arn
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonS3FullAccess

当我在AssumeRolePolicyDocument里添加Resource字段并指定S3桶ARN时（不管是用!GetAtt动态获取还是!Sub拼接ARN），CloudFormation直接报错：

Has prohibited field Resource (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 564fe8df-b168-486b-a11e-5ef7b5689a13; Proxy: null)

用cfn policy validator验证时也得到错误：

ERROR: Failed to create access preview for dev-sftp-078904673178-role.  Validate that your trust or resource policy's schema is correct.

问题根源 #

IAM角色的信任策略（AssumeRolePolicyDocument）的作用是定义哪些实体可以扮演这个角色，按照IAM的策略语法规则，这个类型的策略里不允许出现Resource字段——这就是报错的直接原因，和你填的ARN值无关，只要加了Resource就会触发格式错误。

正确实现方式 #

要限制这个角色只能访问指定的S3桶，需要通过角色的权限策略来实现，而不是在信任策略里添加Resource。我们可以把原来的AmazonS3FullAccess托管策略替换成自定义的内联权限策略，只允许对目标S3桶进行操作。

修正后的完整模板：

Resources:
  S3SFTPBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: !Sub ${Env}-sftp-${AWS::AccountId}
      PublicAccessBlockConfiguration: 
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  SFTPIAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${Env}-sftp-${AWS::AccountId}-role
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service:
                - "transfer.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      # 替换成自定义内联策略，限制仅访问目标S3桶
      Policies:
        - PolicyName: !Sub ${Env}-sftp-bucket-access-policy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  # 根据实际需求调整S3操作权限，这里示例用常用的SFTP相关操作
                  - "s3:ListBucket"
                  - "s3:GetObject"
                  - "s3:PutObject"
                  - "s3:DeleteObject"
                Resource:
                  - !GetAtt S3SFTPBucket.Arn
                  - !Sub ${S3SFTPBucket.Arn}/*

内容的提问来源于stack exchange，提问作者davidb