amazon-web-services - 如何授权远程用户将角色传递给 SAM lambda 部署中生成的角色？

Question

我想用 SAM 部署一个 lambda 函数。为此，我需要将策略分配给LocalDeveloper从他们的机器进行部署的用户。我已经为用户分配了一些权限，现在我得到了Resource handler returned message: "User: arn:aws:iam::0123456789:user/LocalDeveloper is not authorized to perform: iam:PassRole on resource: arn:aws:iam::0123456789:role/<stack name>-<lambda name>-<hash> (Service: Lambda, Status Code: 403, Request ID: 4111d938-73af-41af-a2a8-d0cd3ca9e60c, Extended Request ID: null)" (RequestToken: 85dca9d2-09e7-a9a6-9711-31d9fb6397d6, HandlerErrorCode: AccessDenied)

有一个简单的解决方法：只需添加



        {
            "Effect": "Allow",
            "Action": "iam:PassRole",
            "Resource": [
                "arn:aws:iam::0123456789:role/<stack-name>*"]
        }

到LocalDeveloper的现有政策。但是 AWS 给了我一个安全警告¹：

PassRole With Star In Resource: Using the iam:PassRole action with wildcards (*) in the resource can be overly permissive because it allows iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement

带有指向用户指南的链接

我明白了它的要点：该策略允许将任何角色分配给以 . 开头的任何角色<stack-name>。我知道我无法指定资源 ARN，因为它仅在编译时才知道。这让我add the iam:PassedToService condition key to your statement不得不将政策扩展到

    {
        "Effect": "Allow",
        "Action": "iam:PassRole",
        "Resource": "arn:aws:iam::0123456789:role/<stack-name>*",
        "Condition": {
            "StringLike": {
                "iam:PassedToService": "arn:aws:iam::0123456789:role/<stack-name>*"
            }
        }

或者类似的东西。但是以上并没有解决安全警告（我认为我不能使用角色iam:PassedToService）。如何正确解决此安全警告？

¹ 仅出现安全警告是因为在我的情况下<stack-name>少于 6 个字符，那是因为我使用了几个堆栈共有的前缀。

标签： amazon-web-servicesaws-sam