限制dms-access-for-endpoint IAM角色信任策略时AWS DMS任务失败的问题求助

我正在搭建一套DMS解决方案，用来把Azure SQL Server的数据同步到Redshift。现在想给dms-access-for-endpoint这个IAM角色的信任策略做权限限制，但遇到了棘手的问题。

最开始的基础配置完全正常，策略内容如下：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "dms.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

但只要我稍微添加一点限制条件，DMS就会抛出一个模糊的通用错误。比如下面这个加了源ARN限制的策略就无法正常工作：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "dms.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": [
            "arn:aws:dms:eu-west-2:<account_number>:replication-task:*",
            "arn:aws:dms:eu-west-2:<account_number>:replication-config:*"
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "redshift.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:redshift:eu-west-2:<account_number>:cluster:*"
        }
      }
    }
  ]
}

更奇怪的是，有时候更严格的信任策略居然能间歇性生效。我猜测会不会是IAM变更存在生效延迟？但只要我删除并重新部署DMS任务，任何加了限制的策略都会直接失败。

内容来源于stack exchange