在AWS Academy Learner Lab中调用LabRole替代创建新角色的问题

在AWS Academy Learner Lab环境下，只能使用平台预定义的LabRole，无法创建新的IAM角色——Learner Lab的权限策略限制了角色创建操作。尝试修改Greengrass V2 Workshop的CloudFormation模板（该模板原本用于创建Cloud9、S3、VPC等资源），用LabRole替代模板中自动创建的IAM角色，但执行堆栈创建时触发了权限相关报错。

原CloudFormation模板代码 #

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation template for AWS IoT Greengrass V2 workshop. Creates various resources like Cloud9, S3, VPC and more.",

  "Mappings" : {
    "CONFIG" : {
        "DEPLOYMENT": { "VERSION" : "2021-05-14" },
        "S3BUCKET": { "NAME": "aws-iot-workshop-artifacts" },
        "S3PREFIX": { "NAME": "resources" }
    }
  },

  "Metadata" : {
    "AWS::CloudFormation::Interface" : {
      "ParameterGroups" : [
        {
          "Label" : { "default": "Cloud9 instance type" },
          "Parameters" : [ "C9InstanceType" ]
        }
      ],
      "ParameterLabels" : {
        "C9InstanceType": { "default" : "AWS Cloud9 instance type" }
      }
    }
  },

  "Parameters" : {
    "C9InstanceType" : {
      "Description" : "A valid EC2 instance type.",
      "Type" : "String",
      "Default" : "t3.large",
      "AllowedValues" : [ "t3.medium", "t3.large", "t3.xlarge" ],
      "ConstraintDescription" : "Must be a valid AWS Cloud9 instance type"
    }
  },


  "Resources" : {

    "LambdaJITRRole": {
       "Type": "AWS::IAM::Role",
       "Properties": {
          "AssumeRolePolicyDocument": {
             "Statement": [ {
                "Effect": "Allow",
                "Principal": {
                   "Service": [ "lambda.amazonaws.com" ]
                },
                "Action": [ "sts:AssumeRole" ]
             } ]
          },
          "Policies": [ {
             "PolicyName": {"Fn::Join": ["", ["IoTWSRegLambdaJITRPolicy-", {"Ref": "AWS::Region"} ]]},
             "PolicyDocument": {
                 "Version":"2012-10-17",
                 "Statement":[
                    {
                       "Effect":"Allow",
                       "Action":[
                          "logs:CreateLogGroup",
                          "logs:CreateLogStream",
                          "logs:PutLogEvents"
                       ],
                       "Resource":"arn:aws:logs:*:*:*"
                    },
                    {
                       "Effect":"Allow",
                       "Action":[
                          "iot:CreateThing",
                          "iot:UpdateCertificate",
                          "iot:CreatePolicy",
                          "iot:AttachPolicy",
                          "iot:DescribeCertificate",
                          "iot:AttachThingPrincipal"
                       ],
                       "Resource":"*"
                    }
                 ]
              }
             }
           ],
          "Path": "/service-role/"
        }
    },

    "C9SecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "VpcId" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.VpcId" ] },
        "GroupDescription" : "Enable access to MQTT port",
        "Tags" : [ { "Key" : "Name", "Value" : "C9 IoT workshop" } ],
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : 8883, "ToPort" : 8883, "CidrIp" : "127.0.0.0/8"}
        ]
      }
    },

    "MiscResources" : {
      "Type" : "AWS::CloudFormation::Stack",
      "Properties" : {
        "TemplateURL" : {
           "Fn::Sub": [
              "https://${S3Bucket}.s3.amazonaws.com/${S3Prefix}/${Version}/cfn/cfn-iot-misc.json",
               {
                 "S3Bucket": { "Fn::FindInMap" : [ "CONFIG", "S3BUCKET", "NAME"] },
                 "S3Prefix": { "Fn::FindInMap" : [ "CONFIG", "S3PREFIX", "NAME"] },
                 "Version": { "Fn::FindInMap" : [ "CONFIG", "DEPLOYMENT", "VERSION"] }
               }
           ]
        }
      }
    },

    "C9Instance" : {
      "Type" : "AWS::CloudFormation::Stack",
      "Properties" : {
        "TemplateURL" : {
           "Fn::Sub": [
              "https://${S3Bucket}.s3.amazonaws.com/${S3Prefix}/${Version}/cfn/cfn-iot-c9-v2.json",
               {
                 "S3Bucket": { "Fn::FindInMap" : [ "CONFIG", "S3BUCKET", "NAME"] },
                 "S3Prefix": { "Fn::FindInMap" : [ "CONFIG", "S3PREFIX", "NAME"] },
                 "Version": { "Fn::FindInMap" : [ "CONFIG", "DEPLOYMENT", "VERSION"] }
               }
           ]
        },
        "Parameters" : {
          "C9InstanceType": { "Ref": "C9InstanceType" },
          "C9ImageId": "ubuntu-18.04-x86_64",
          "C9SecurityGroupId": { "Ref": "C9SecurityGroup" },
          "C9StopTime": 180,
          "IoTPolicy": { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTPolicy" ] },
          "IoTServiceRoleArn": { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleArn" ] },
          "RootStackName": { "Ref": "AWS::StackName" },
          "SubnetId": { "Fn::GetAtt" : [ "MiscResources", "Outputs.PubSubnetIdA" ] },
          "S3BucketArn": { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketArn" ] },
          "S3BucketName": { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketName" ] },
          "Workshop": "AwsWorkshop/IoT/GreengrassV2",
          "UserDataScript": "c9-ub1804-ggv2-user-data.sh"
        }
      }
    }
  },

  "Outputs" : {
    "AWSCloud9URL": {
      "Description": "URL to access your AWS Cloud9 IDE",
      "Value": { "Fn::GetAtt" : [ "C9Instance", "Outputs.AWSCloud9URL" ] }
    },
    "AWSCloud9Id": {
      "Description": "Environment Id of your AWS Cloud9 IDE",
      "Value": { "Fn::GetAtt" : [ "C9Instance", "Outputs.AWSCloud9Id" ] }
    },
    "S3Bucket" : {
      "Description" : "Name of the S3 Bucket for the IoT workshop",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.S3BucketName" ] }
    },
    "IoTPolicy" : {
      "Description" : "Name of the IoT policy for JITP",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTPolicy" ] }
    },
    "IoTServiceRoleArn" : {
      "Description" : "Role Arn for IoT device provisiong",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleArn" ] }
    },
    "IoTServiceRoleName" : {
      "Description" : "Role name for IoT device provisiong/rule actions",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.IoTServiceRoleName" ] }
    },
    "ArnLambdaRole" : {
      "Description" : "Role Arn for the JITR Lambda function",
      "Value" : { "Fn::GetAtt" : ["LambdaJITRRole", "Arn"] }
    },
    "GGOtaS3UrlSignerRoleArn" : {
      "Description" : "The IAM role arn for OTA which is used to presign the S3 url which links to the Greengrass software update.",
      "Value" : { "Fn::GetAtt" : [ "MiscResources", "Outputs.GGOtaS3UrlSignerRoleArn" ] }
    }
  }
}

报错截图 #

内容的提问来源于stack exchange，提问作者José Antonio Morán Rodríguez