MalformedPolicyDocument policy config_error ai_generated true

错误：策略中的主体无效：'AWS: arn:aws:iam::123456789012:role/NonExistentRole'

Error: Invalid principal in policy: 'AWS: arn:aws:iam::123456789012:role/NonExistentRole'

ID: policy/aws-iam-role-trust-policy-invalid-principal

其他格式: JSON · Markdown 中文 · English
90%修复率
86%置信度
1证据数
2023-09-05首次发现

版本兼容性

版本状态引入弃用备注
AWS IAM API 2010-05-08 active — — —
aws-cli 2.14.0 active — — —

根因分析

IAM角色信任策略引用了一个不存在或拼写错误的主体（例如另一个角色或账户），导致策略被拒绝。

English

IAM role trust policy references a principal (e.g., another role or account) that does not exist or is misspelled, causing the policy to be rejected.

generic

官方文档

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_principal.html

解决方案

  1. 通过运行以下命令验证ARN是否存在：aws iam get-role --role-name NonExistentRole。如果不存在，则创建角色或更正ARN。示例：将ARN更改为arn:aws:iam::123456789012:role/ExistingRole。
  2. 如果信任策略应该允许账户中的任何角色，则使用通配符主体如'AWS: *'，但这在安全上有风险。

无效尝试

常见但无效的做法:

  1. Use the role ID instead of ARN in the principal 100% 失败

    IAM policies require ARN format for principals; role IDs are not accepted in principal elements.

  2. Add the principal as a service (e.g., 'Service: ec2.amazonaws.com') even if it's a role 90% 失败

    Service principals are for AWS services, not IAM roles; mixing types causes validation errors.