问题描述
我有一个 cloudformation 堆栈,可以导出此角色并附加一些策略:
Codebuildrole:
Type: AWS::IAM::Role
Properties:
RoleName: codebuild-role
AssumeRolePolicyDocument:
Statement:
- Action: ['sts:AssumeRole']
Effect: Allow
Principal:
Service:
- codebuild.amazonaws.com
- codepipeline.amazonaws.com
Version: '2012-10-17'
Path: /
Policies:
- etc....
导出的角色名称是 cb-remove-role-id
,然后我尝试将其导入另一个堆栈,以供代码管道中的另一个代码构建项目使用
BuildProjectUK:
Type: AWS::CodeBuild::Project
Properties:
Name: !Sub ${ResourceContext}-build-uk
Description: UK build and deploy
ServiceRole: !ImportValue cb-remove-role-id
BadgeEnabled: false
Artifacts:
Type: CODEPIPELINE
Environment:
etc...
未能调用 UpdateProject,原因:CodeBuild 未被授权执行:sts:AssumeRole on arn:aws:iam::xxxxxxxxx:role/xxxxxxxxx(服务:AWSCodeBuild;状态代码:400;错误代码:InvalidInputException;请求 ID : xxxxxxxxxxxxxxxx; 代理: null)
知道为什么会这样或我如何解决这个问题吗?
谢谢
解决方法
使用 Arn 而不是 RoleId 导出角色解决了问题谢谢@Marcin
失败的输出:
CodeBuildRemoveRoleId:
Description: ID of role used by remove codebuild project
Value: !GetAtt CodeBuildRole.RoleId
Export:
Name: cb-remove-role-id
传递输出:
CodeBuildRemoveRoleId:
Description: ID of role used by remove codebuild project
Value: !GetAtt CodeBuildRole.Arn
Export:
Name: cb-remove-role-id