获取Cloudformation错误:未成功创建嵌入式堆栈

Question

我已经创建了一个父(嵌套)堆栈模板，它引用了4个子模板。当我通过aws cloudformation create-stack启动堆栈时，会得到父堆栈的以下错误：

Embedded stack AlignmentLambdaFunction was not successfully created: The following resource(s) failed to create: [CloudspanLambdaFunction, HaploLambdaExecutionRole, AlignmentLambdaExecutionRole].

在从父层创建的嵌套堆栈中，我得到了这个错误：Policy contains a statement with one or more invalid principals (对于MasterGCPStorageKey (这是上面Lambda子级中的一个资源)

我不明白错误的根源。我想可能是因为ExecutionRoles需要一个ExecutionRoles，但这并没有解决错误。

父堆栈

AWSTemplateFormatVersion: "2010-09-09"
Description: "Master template for wgs-pipeline. Calls to other stack templates."
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
  AlignmentLambdaFuncS3KeyName:
    Type: String
  AlignmentLambdaFuncModuleName:
    Type: String
  HaploLambdaFuncS3BucketName:
    Type: String
  HaploLambdaFuncS3KeyName:
    Type: String
  HaploLambdaFuncModuleName:
    Type: String
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: 'VPC'
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: 
        Ref: 'VPC'
      InternetGatewayId: 
        Ref: 'InternetGateway'
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Security Group for instances launched in the VPC by Batch
      VpcId: 
        Ref: 'VPC'
  StepFunctionsActivitiesInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 128.218.0.0/16
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/24
      VpcId: 
        Ref: 'VPC'
      AvailabilityZone: 
        Ref: GPCESubnetAZ1
      MapPublicIpOnLaunch: 'True'
    DependsOn: VPC

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: 
        Ref: 'InternetGateway'
    DependsOn:
      - RouteTable
      - InternetGateway
  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      SubnetId: 
        Ref: 'Subnet'
    DependsOn:
      - RouteTable
      - Subnet

  # Beginning of reference to child stacks

  ClouspanLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        CloudspanLambdaFuncS3BucketName: 
          Ref: CloudspanLambdaFuncS3BucketName
        CloudspanLambdaFuncS3KeyName: 
          Ref: CloudspanLambdaFuncS3KeyName
        CloudspanLambdaFuncModuleName: 
          Ref: CloudspanLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  AlignmentLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        AlignmentLambdaFuncS3BucketName: 
          Ref: AlignmentLambdaFuncS3BucketName
        AlignmentLambdaFuncS3KeyName: 
          Ref: AlignmentLambdaFuncS3KeyName
        AlignmentLambdaFuncModuleName: 
          Ref: AlignmentLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  HaploLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        HaploLambdaFuncS3BucketName: 
          Ref: HaploLambdaFuncS3BucketName
        HaploLambdaFuncS3KeyName: 
          Ref: HaploLambdaFuncS3KeyName
        HaploLambdaFuncModuleName: 
          Ref: HaploLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

Lambda子堆栈(与错误相关)

AWSTemplateFormatVersion: '2010-09-09'
Description: lambda function and execution role stack.
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  AlignmentLambdaFuncS3KeyName:
    Type: String
    Default: 'alignment_processing.deployable.zip'
  AlignmentLambdaFuncModuleName:
    Type: String
    Default: 'alignment_processing'
  HaploLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  HaploLambdaFuncS3KeyName:
    Type: String
    Default: 'sentieon_haplotyper.deployable.zip'
  HaploLambdaFuncModuleName:
    Type: String
    Default: 'sentieon_haplotyper'
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String


Resources:

  CloudspanLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: CloudspanLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: CloudspanLambdaFuncS3BucketName
        S3Key:
          Ref: CloudspanLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: CloudspanLambdaExecutionRole

  AlignmentLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: AlignmentLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ AlignmentLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: AlignmentLambdaFuncS3BucketName
        S3Key:
          Ref: AlignmentLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: AlignmentLambdaExecutionRole

  HaploLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: HaploLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ HaploLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: HaploLambdaFuncS3BucketName
        S3Key:
          Ref: HaploLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: HaploLambdaExecutionRole


  CloudspanLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*


  AlignmentLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  HaploLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  MasterGCPStorageKey:
    Type: "AWS::KMS::Key"
    Properties:
      Description: Symmetric Master Key for GCP Storage Credentials off-line encryption/on-line decryption protocol
      Enabled: True
      EnableKeyRotation: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
        - Sid: "Allow Lambda Excution Role access to GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of CloudspanLambdaExecutionRole
            AWS:
              Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
          Action:
            - kms:Decrypt
            - kms:DescribeKey
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow Administrator to admin the GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of the KMS admin IAM user
            AWS:
              Ref: KMSAdminUserARN
          Action:
            - "kms:Create*"
            - "kms:Describe*"
            - "kms:Enable*"
            - "kms:List*"
            - "kms:Put*"
            - "kms:Update*"
            - "kms:Revoke*"
            - "kms:Disable*"
            - "kms:Get*"
            - "kms:Delete*"
            - "kms:TagResource"
            - "kms:UntagResource"
            - "kms:ScheduleKeyDeletion"
            - "kms:CancelKeyDeletion"
            - "kms:Encrypt"
            - "kms:Decrypt"
            - "kms:ReEncrypt"
            - "kms:GenerateDataKey*"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow End User to encrypt the GCP Storage creds"
          Effect: "Allow"
          Principal:
            # ARN of the KMS IAM end user
            AWS:
              Ref: KMSEndUserARN
          Action:
            - "kms:Encrypt"
            - "kms:ReEncrypt"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
    DependsOn: CloudspanLambdaExecutionRole

Answer 1

在重新部署我删除的CloudFormation堆栈(通过Serverless)之后，我还得到了以下错误：

We encountered the following errors while processing your request:
Policy contains a statement with one or more invalid principals.

在我的例子中，分配给我的KMS加密密钥的原始角色被删除了。KMS仍然保留对已删除角色的引用，显然添加相同类型的新创建的角色会创建此错误。

我简单地删除了对已删除角色的旧引用，在IAM > Encryption Keys > YOUR_KEY_NAME > Key Policy > Key Users下解决了这个问题。