An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: Has prohibited field Resource

Mitchell Privett 0
Viewed 16

I'm trying to use boto3 to create a role in another account, I found an example online of implementing a policy document and doing so gave me the error "An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: Has prohibited field Resource"

Here's my code and the policy document I'm trying to use to create a role

import boto3
import os, json

os.environ['AWS_PROFILE'] = "default"
os.environ['AWS_DEFAULT_REGION'] = "us-west-1"

assume_role_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "iam:ListRoles",
                "sts:AssumeRole"
            ],
            "Resource": "*"
        }
    ]
}

def test ():
    sts_client = boto3.client('sts')

    assumed_role_object=sts_client.assume_role(
    RoleArn="arn:aws:iam::456522242738:role/OrganizationAccountAccessRole",
    RoleSessionName="AssumeRoleSession1")

    credentials=assumed_role_object['Credentials']
    access_key = credentials['AccessKeyId']
    secret_key = credentials['SecretAccessKey']
    session_token = credentials['SessionToken']
    

    client = boto3.client('iam', 
    aws_access_key_id=access_key,
    aws_secret_access_key=secret_key,
    aws_session_token=session_token
    )

    response = client.create_role(
    RoleName='CF-AssumeRole',
    AssumeRolePolicyDocument=json.dumps(assume_role_policy)
    )

    print(response)

test()

What could be causing the error with my assume_role_policy?

amazon-iam boto3 amazon-web-services
1 Answers

The assume role policy grants an entity permission to assume the role. It is not tied to a specific resource.

If you want to grant access to anyone, then you should use:

assume_role_policy = {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ec2:Describe*",
                "iam:ListRoles",
                "sts:AssumeRole"
            ],
            "Principal": "*"
        }
    ]
}

be careful with this though

Acuriousmind0
Related