Error creating IAM Role - Value of property PolicyDocument must be an object

user_14115824 0
Viewed 612

I am creating an IAM role in order to send logs from a stack to kinesis stream in another stack. When I add permission policy, it fails with the error :

"Value of property PolicyDocument must be an object".

This is my cloudformation.template.yml :

  KinesisRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: {'Fn::Sub': 'Kinesis-Role-${AWS::Region}'}
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [logs.amazonaws.com]
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName: KinesisPolicy
        PolicyDocument:
        - Version: '2017-10-17'
          Statement:
          - Action: ['kinesis:PutRecord']
            Effect: Allow
            Resource: '*'
amazon-kinesis amazon-cloudformation amazon-web-services yaml
1 Answers

Your current PolicyDocument is a list of objects due to - in front of Version. Also your Version is wrong. So it should be:

 KinesisRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: {'Fn::Sub': 'Kinesis-Role-${AWS::Region}'}
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [logs.amazonaws.com]
          Action: ['sts:AssumeRole']
      Policies:
      - PolicyName: KinesisPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Action: ['kinesis:PutRecord']
            Effect: Allow
            Resource: '*'
user_2488230
Related