{
  "id": "policy/aws-iam-role-trust-policy-invalid-principal",
  "signature": "Error: Invalid principal in policy: 'AWS: arn:aws:iam::123456789012:role/NonExistentRole'",
  "signature_zh": "错误：策略中的主体无效：'AWS: arn:aws:iam::123456789012:role/NonExistentRole'",
  "regex": "Invalid principal in policy: 'AWS: arn:aws:iam::\\d{12}:role/[^']+'",
  "domain": "policy",
  "category": "config_error",
  "subcategory": null,
  "root_cause": "IAM role trust policy references a principal (e.g., another role or account) that does not exist or is misspelled, causing the policy to be rejected.",
  "root_cause_type": "generic",
  "root_cause_zh": "IAM角色信任策略引用了一个不存在或拼写错误的主体（例如另一个角色或账户），导致策略被拒绝。",
  "versions": [
    {
      "version": "AWS IAM API 2010-05-08",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "aws-cli 2.14.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "Use the role ID instead of ARN in the principal",
      "why_fails": "IAM policies require ARN format for principals; role IDs are not accepted in principal elements.",
      "fail_rate": 1.0,
      "condition": "",
      "sources": []
    },
    {
      "action": "Add the principal as a service (e.g., 'Service: ec2.amazonaws.com') even if it's a role",
      "why_fails": "Service principals are for AWS services, not IAM roles; mixing types causes validation errors.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole.",
      "success_rate": 0.95,
      "how": "Verify the ARN exists by running: aws iam get-role --role-name NonExistentRole. If it doesn't exist, create the role or correct the ARN. Example: change ARN to arn:aws:iam::123456789012:role/ExistingRole.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security.",
      "success_rate": 0.7,
      "how": "Use a wildcard principal like 'AWS: *' if the trust policy should allow any role in the account, but this is risky for security.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "通过运行以下命令验证ARN是否存在：aws iam get-role --role-name NonExistentRole。如果不存在，则创建角色或更正ARN。示例：将ARN更改为arn:aws:iam::123456789012:role/ExistingRole。",
    "如果信任策略应该允许账户中的任何角色，则使用通配符主体如'AWS: *'，但这在安全上有风险。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html",
  "official_doc_section": null,
  "error_code": "MalformedPolicyDocument",
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-09-05",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}