amazon-web-services - 角色不能由 events.amazonaws.com 承担

Question

我正在尝试使用代码放置 cloudwatch 事件规则:

await cloudwatchevents.putRule({
  Name: 'xxx-ec2-start',
  EventPattern: '{"source":["aws.ec2"],"detail-type":["EC2 Instance State-change Notification"],"detail":{"state":["running"]}}',
  State: 'ENABLED',
  RoleArn: `arn:aws:iam::${account.Id}:role/skynet-cloudwatch-eventbus`,
}).promise()

但是，我得到:

(节点:29939)未处理的PromiseRejectionWarning:ValidationException:主体“events.amazonaws.com”不能承担提供的角色“arn:aws:iam::00000000000:role/xxx-cloudwatch-eventbus”。

该角色已经具有允许的假定策略文档 events.amazonaws.com .为什么还是失败？

Answer 1

您收到此错误的原因是“events.amazonaws.com”未列为角色 theRole 的可信实体。(在您的情况下为 skynet-cloudwatch-eventbus)

解决此问题的一种方法是转到 https://console.aws.amazon.com/iam/home?region=us-east-1#roles/theRole (将此链接调整为您所在的地区 + 真实角色名称)> 信任关系选项卡 > 编辑信任关系按钮 > 粘贴在服务下的“events.amazonaws.com”，如下面的示例所示。

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "lambda.amazonaws.com",
          "apigateway.amazonaws.com",
          "events.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]