用户无权执行:cloudformation:CreateStack

我正在尝试无服务器来创建AWS Lambdas,并在使用命令创建项目时serverless project create遇到以下错误.

AccessDenied: User: arn:aws:iam::XXXXXXXXX:user/XXXXXXXXX is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-east-1:XXXXXXXXX:stack/XXXXXXXXX-development-r/*

我创建了一个用户并向用户授予了以下权限.

AWSLambdaFullAccess

AmazonS3FullAccess

CloudFrontFullAccess

AWSCloudFormationReadOnlyAccess(没有AWSCloudFormationFullAccess授予)

我该怎么办？我必须授予哪些其他权限？

1> tedder42..：

---

你提到的最接近的一个是AWSCloudFormationReadOnlyAccess,但显然这只是你需要的只读cloudformation:CreateStack.将以下内容添加为用户策略.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1449904348000",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

您完全有可能需要更多权限 - 例如,启动EC2实例,(重新)配置安全组等.

---

您将我提供的文本粘贴为自定义用户策略.

---

我发现它很奇怪,通过它们的拖放UI无法获得,谢谢.

---

我怎样才能授予`cloudformation:CreateStack`？我正在使用AWS UI而不是CLI.

2> Chris Master..：

---

什么@ tedder42说,但我还必须在我的组策略中添加以下内容才能从visual studio内部部署到lambda.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1449904348000",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:CreateChangeSet",
                "cloudformation:ListStacks",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

---

如果您尝试使用无服务器进行部署,那么这个答案应该被赞成并且+1给@pdeschen说你还需要添加`cloudformation:DescribeStacks`.我还必须添加`cloudformation:DescribeStackResource`,`cloudformation:ValidateTemplate`

---

如果你打算做"无服务器信息",你还需要`cloudformation:DescribeStacks`.

3> mancvso..：

---

根据我最近的经验，所需的政策是

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Stmt1449904348000",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:CreateChangeSet",
                "cloudformation:ListStacks",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackEvents",
                "cloudformation:ValidateTemplate",
                "cloudformation:DescribeChangeSet",
                "cloudformation:ExecuteChangeSet"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}