MalformedPolicyDocumentExceptionnull AWS КЛЮЧ KMS

Question

• 1000 *

Template:

PcsKmsCmk1:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: 2012-10-17
        Id: default
        Statement:
          - Sid: Allow root account all permissions except to decrypt the key
            Effect: Allow
            Principal:
              AWS:
               - !Sub arn:aws:iam::${AWS::AccountId}:root
            Action: kms:*
            Resource: '*'
          - Sid: Enable AWSAdminRole to have full permissions to KMS key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:aws:iam::${AWS::AccountId}:/role/AWSAdminRole
            Action: kms:*
            Resource: '*'
        Condition:
              Bool:
                 kms:GrantIsForAWSResource: 'true'

Answer 1

В ARN вы использовали /role, что неверно.

Для справки

Используйте - !Sub arn:aws:iam::${AWS::AccountId}:role/AWSAdminRole вместо - !Sub arn:aws:iam::${AWS::AccountId}:/role/AWSAdminRole