未授权用户在资源上执行: iam:PassRole

Question

我试图使用以下命令通过aws cli创建一个ek集群：

aws eks create-cluster --name ekCsluster --role-arn arn:aws:iam::111111111111:role/eksServiceRole --resources-vpc-config subnetIds=subnet-1,subnet-2,subnet-3,subnet-4,subnet-5,subnet-6,securityGroupIds=sg-1

并得到以下错误：

An error occurred (AccessDeniedException) when calling the CreateCluster operation: User: arn:aws:iam::111111111111:user/userName is not authorized to perform: iam:PassRole on resource: arn:aws:iam::111111111111:role/eksServiceRole

但是，我已经创建了一个权限策略AssumeEksServiceRole，并将其直接附加到用户arn:aws:iam::111111111111:user/userName：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::111111111111:role/eksServiceRole"
        }
    ]
}

在eksServiceRole角色中，我将信任关系定义为：

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "eks.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:user/userName"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

我遗漏了什么？如何调试此错误消息？谢谢你的帮助。

Answer 1

我会尝试将用户从信任关系中删除(这是不必要的)。当将帐户和服务混合作为信任关系中的主体时，AWS服务不能很好地发挥作用，例如，如果您尝试使用CodeBuild来实现这一点，它会抱怨说它不拥有主体。

Answer 2

在您的情况下，您只需使用：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::111111111111:role/eksServiceRole"
        }
    ]
}

我用这个：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CustomEditor",
            "Effect": "Allow",
            "Action": [
                "iam:GetRole",
                "iam:PassRole"
            ],
            "Resource": "*"
        }
    ]
}

您在eksServiceRole角色中的条目是不必要的。