Sam部署遇IAM显式拒绝，CloudFormation GUI重试却正常

案例1：SAM模板部署失败，IAM权限显式拒绝报错 #

此前正常运行的template.yaml文件，未做修改但无法部署，报错信息：

API: iam:PutRolePolicy User: arn:aws:iam::xxxxxoooo:user/ray is not authorized to perform: iam:PutRolePolicy on resource: role cron-LambdaExecutionRole-PTYXWCAQZPOE with an explicit deny in an identity-based policy

已尝试以下操作但均无效：

• 为用户ray添加AdministratorAccess权限，报错依旧
• 将模板中5个服务精简为1个，仍失败
• 为角色添加内联策略
• 重新安装AWS SAM CLI（brew install aws-sam-cli）

但在CloudFormation控制台点击重试按钮能成功部署。

案例2：极简CloudFormation模板部署失败 #

模板内容 #

AWSTemplateFormatVersion: '2010-09-09' 
Resources:
  BatchTaskFargateRole:
    DeletionPolicy: Retain
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action:
              - sts:AssumeRole
            Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
    Type: AWS::IAM::Role
Transform: AWS::Serverless-2016-10-31

部署结果 #

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ResourceStatus                                 ResourceType                                   LogicalResourceId                              ResourceStatusReason
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
CREATE_IN_PROGRESS                             AWS::IAM::Role                                 BatchTaskFargateRole                           -
CREATE_IN_PROGRESS                             AWS::IAM::Role                                 BatchTaskFargateRole                           Did not have IAM permissions to process tags
                                                                                                                                             on AWS::IAM::Role resource.
CREATE_FAILED                                  AWS::IAM::Role                                 BatchTaskFargateRole                           API: iam:CreateRole User:
                                                                                                                                             arn:aws:iam::xxxxx00000:user/ray is not
                                                                                                                                             authorized to perform: iam:CreateRole on
                                                                                                                                             resource:
                                                                                                                                             arn:aws:iam::xxxxx00000:role/
                                                                                                                                             BatchTaskFargateRole-1SCd8L0GR
                                                                                                                                             with an explicit deny in an identity-based
                                                                                                                                             policy
CREATE_FAILED                                  AWS::CloudFormation::Stack                     test-cloudformation-stack                      The following resource(s) failed to create:
                                                                                                                                             [BatchTaskFargateRole].

• 排查身份策略中的显式拒绝规则：AWS权限体系中，显式拒绝优先级高于允许权限，哪怕有AdministratorAccess也会被覆盖。进入IAM控制台，检查用户ray的所有身份策略（包括直接附加的、用户组继承的），搜索包含iam:PutRolePolicy、iam:CreateRole的Deny语句，删除或调整这些规则。
• 确认部署使用的身份凭证：检查本地SAM CLI生效的凭证是否为用户ray，执行aws configure list查看当前配置的账号、权限信息，避免误用了其他带拒绝策略的身份。
• 检查AWS组织SCP限制：如果账号属于AWS组织，需查看组织级服务控制策略（SCP），确认对应OU或账号是否被添加了限制IAM操作的Deny条目，如有需调整SCP规则。
• 清理SAM CLI本地缓存：执行sam local delete-cache清除本地缓存的凭证或配置，之后重新尝试部署。
• 使用CloudFormation服务角色部署：若用户身份存在无法绕过的权限限制，可创建一个拥有完整CloudFormation部署权限的服务角色，部署时指定该角色：

  sam deploy --role-arn arn:aws:iam::你的账号ID:role/CloudFormation服务角色名
  

内容的提问来源于stack exchange，提问作者Ray Chang