MalformedPolicyDocument policy config_error ai_generated true

Error: Invalid principal in policy: 'AWS: arn:aws:iam::123456789012:role/NonExistentRole'

ID: policy/aws-iam-role-trust-policy-invalid-principal

Also available as: JSON · Markdown · 中文
90%Fix Rate
86%Confidence
1Evidence
2023-09-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
AWS IAM API 2010-05-08 active — — —
aws-cli 2.14.0 active — — —

Root Cause

IAM role trust policy references a principal (e.g., another role or account) that does not exist or is misspelled, causing the policy to be rejected.

generic

中文

IAM角色信任策略引用了一个不存在或拼写错误的主体（例如另一个角色或账户），导致策略被拒绝。

Official Documentation

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html

Workarounds

  1. 95% success Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole. 
    Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole.
  2. 70% success Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security. 
    Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security.

中文步骤

  1. 通过运行以下命令验证ARN是否存在：aws iam get-role --role-name NonExistentRole。如果不存在，则创建角色或更正ARN。示例：将ARN更改为arn:aws:iam::123456789012:role/ExistingRole。
  2. 如果信任策略应该允许账户中的任何角色，则使用通配符主体如'AWS: *'，但这在安全上有风险。

Dead Ends

Common approaches that don't work:

  1. Use the role ID instead of ARN in the principal 100% fail

    IAM policies require ARN format for principals; role IDs are not accepted in principal elements.

  2. Add the principal as a service (e.g., 'Service: ec2.amazonaws.com') even if it's a role 90% fail

    Service principals are for AWS services, not IAM roles; mixing types causes validation errors.