IAM策略创建报错：JSON字符串不得含前导空格求助

排查步骤与解决方案 #

1. 移除前导空白字符
   报错直接指向JSON开头存在多余空格或空白字符，请确保策略内容第一个字符就是{，前面没有任何空格、换行或制表符。复制粘贴时很容易不小心带入这类字符，导致校验失败。

2. 检查JSON语法合法性
   虽然报错提示是前导空格，但部分语法问题也可能触发类似提示。可以用本地代码编辑器的JSON校验功能检查：

   • 原策略中前两个Statement的Resource字段设为""，这对部分IAM Action不合法，建议根据需求改为"*"或具体资源ARN。
   • 检查是否存在多余逗号或缺失闭合符号，当前代码的数组逗号使用合规，空行不会影响解析。

修正后的策略代码 #

以下是调整Resource字段并确保无前置空格的版本：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Deny",
      "Action": [
        "iam:CreateServiceSpecificCredential",
        "iam:DeleteAccessKey",
        "iam:GetServiceLastAccessedDetailsWithEntities",
        "iam:GenerateServiceLastAccessedDetails",
        "iam:PutRolePermissionsBoundary",
        "iam:ListPoliciesGrantingServiceAccess",
        "iam:UpdateOpenIDConnectProviderThumbprint",
        "iam:ResetServiceSpecificCredential",
        "iam:DeleteSSHPublicKey",
        "iam:ListServiceSpecificCredentials",
        "iam:CreateSAMLProvider",
        "iam:TagSAMLProvider",
        "iam:DeleteRolePermissionsBoundary",
        "iam:GetServiceLastAccessedDetails",
        "iam:GetOrganizationsAccessReport",
        "iam:CreateAccessKey",
        "iam:ListSSHPublicKeys",
        "iam:GenerateOrganizationsAccessReport",
        "iam:ListOpenIDConnectProviderTags",
        "iam:CreateAccountAlias",
        "iam:ListSAMLProviderTags",
        "iam:UploadSSHPublicKey",
        "iam:DeleteAccountAlias",
        "iam:DeleteOpenIDConnectProvider",
        "iam:UpdateSAMLProvider",
        "iam:GetSAMLProvider",
        "iam:ListAccessKeys",
        "iam:UpdateServiceSpecificCredential",
        "iam:UntagSAMLProvider",
        "iam:ListSAMLProviders",
        "iam:RemoveClientIDFromOpenIDConnectProvider",
        "iam:PutUserPermissionsBoundary",
        "iam:GetAccessKeyLastUsed",
        "iam:GetSSHPublicKey",
        "iam:UpdateAccessKey",
        "iam:DeleteUserPermissionsBoundary",
        "iam:UpdateSSHPublicKey",
        "iam:CreateOpenIDConnectProvider",
        "iam:ListOpenIDConnectProviders",
        "iam:ListAccountAliases",
        "iam:UntagOpenIDConnectProvider",
        "iam:GetOpenIDConnectProvider",
        "iam:AddClientIDToOpenIDConnectProvider",
        "iam:DeleteServiceSpecificCredential",
        "iam:TagOpenIDConnectProvider",
        "iam:DeleteSAMLProvider"
      ],
      "Resource": "*"
    },
    {
      "Sid": "VisualEditor1",
      "Effect": "Deny",
      "Action": [
        "iam:UpdateAssumeRolePolicy",
        "iam:PutUserPermissionsBoundary",
        "iam:PutUserPolicy",
        "iam:CreatePolicyVersion"
      ],
      "Resource": "*"
    },
    {
      "Sid": "VisualEditor2",
      "Effect": "Allow",
      "Action": ["iam:CreateUser"],
      "Resource": "*"
    },
    {
      "Sid": "VisualEditor3",
      "Effect": "Deny",
      "Action": ["iam:AttachGroupPolicy", "iam:AttachUserPolicy", "iam:AttachRolePolicy"],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "iam:PolicyARN": "arn:aws:iam::758773684219:policy/KodeKloudIAMPolicy"
        },
        "StringNotEqualsIgnoreCase": {
          "iam:PolicyARN": "arn:aws:iam::758773684219:policy/KodeKloudEC2Policy"
        }
      }
    }
  ]
}

额外提示 #

• 粘贴策略时建议直接从代码编辑器复制，避免从富文本编辑器（如Word）复制，防止带入隐藏格式字符。
• AWS IAM策略对JSON格式要求严格，任何多余空白字符、语法错误都会导致创建失败，提前用校验工具排查能节省时间。

内容的提问来源于stack exchange，提问作者Moinulla Hussaini