A PolicyStatement used in an identity-based policy cannot specify any IAM principals error

user_417892 0
Viewed 4153
    let servicePrincipal: any = new iam.ServicePrincipal("lambda.amazonaws.com");

    let policyDoc = new iam.PolicyDocument({
      statements: [
        new iam.PolicyStatement({
          actions: ["sts:AssumeRole"],
          principals: [servicePrincipal],
          effect: iam.Effect.ALLOW,
          resources: ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"],
          sid: ""
        })
      ],
    });

    let accessRole: any = new iam.Role(this, 'git-access-role', {
      assumedBy: servicePrincipal,
      inlinePolicies: { policyDoc }
    });

I'm creating a cdk lambda with a role that has AWSLambdaBasicExecutionRole but I get an error saying

A PolicyStatement used in an identity-based policy cannot specify any IAM principals

not quite sure...what does it mean and what should I do?

amazon-iam aws-cdk aws-lambda amazon-web-services
1 Answers

Looks like you're trying to generate the assume role policy with policyDoc. The assumedBy: servicePrincipal line will automatically generate the trust policy. If all you want to do is assign the lambda basic execution policy to the role, then it should look like this:

const accessRole = new iam.Role(this, 'git-access-role', {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
  managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaBasicExecutionRole')]
});

If the lambda needs access to git as the construct id of the role seems to indicate then you can add those permissions as inline policies. But this code would create a role that is assumable by a lambda and it would have the most basic permissions a lambda needs to run.

user_120934170
Related