放大，用户无权在资源上执行iam:passRole

Question

所以我试图初始化一个现有的“反应”放大项目，其中配置了大约8个服务。当我运行放大推送时，除了以下内容，一切似乎都很好，也很成功，我得到了这个错误：

Resource Name: 2021/10/08/[$LATEST]c1c602b361e347ad83d49f77293e6aae (Custom::LambdaCallout)
Event Type: create
Reason: Received response status [FAILED] from custom resource. Message returned: See the details in CloudWatch Log Stream: 2021/10/08/[$LATEST]c1c602b361e347ad83d49f77293e6aae (RequestId: 90c39ffc-b3ee-4830-ae87-7df3cd3a0770)

以下是给定地址的cloudwatch日志：

2021-10-08T06:28:37.448Z    d30823f5-a9f8-4d7e-a823-dd53b298a2fb    INFO    Response body:
 
{
    "Status": "FAILED",
    "Reason": "See the details in CloudWatch Log Stream: 2021/10/08/[$LATEST]3b533dd8fb9a43bc921cfe635d2bc945",
    "PhysicalResourceId": "2021/10/08/[$LATEST]3b533dd8fb9a43bc921cfe635d2bc945",
    "StackId": "arn:aws:cloudformation:us-east-1:474847889857:stack/amplify-storyliner-staging-44500-authstorylinerb9277983-1V5J90W5KFK1A/cef02b40-2800-11ec-bcb5-0adb3c7f2f15",
    "RequestId": "f7b5fc9e-0a46-43ae-bf7e-eb19fb81285e",
    "LogicalResourceId": "MFALambdaInputs",
    "NoEcho": false,
    "Data": {
        "err": {
            "message": "User: arn:aws:sts::474847889857:assumed-role/storylb9277983_totp_lambda_role-staging/amplify-storyliner-staging-44500-authsto-MFALambda-tA8KTT12iWvY is not authorized to perform: iam:PassRole on resource: arn:aws:iam::474847889857:role/snsb927798344500-staging because no identity-based policy allows the iam:PassRole action",
            "code": "AccessDeniedException",
            "time": "2021-10-08T06:28:37.445Z",
            "requestId": "3978bf89-5872-460d-b991-c3cd4e5280e1",
            "statusCode": 400,
            "retryable": false,
            "retryDelay": 38.192028876441576
        }
    }
}

我试图创建角色“snsb927798344500 staging”并添加所需的策略，但当我尝试重新运行放大推送命令时，我收到一个错误，称snsb927798344500 staging已经存在。所以我认为是amplify在每一次推送中创建了角色，并且在过程失败后删除了它。这就是为什么在推送过程之后，我无法再次看到“snsb927798344500 staging”角色的原因。

Answer 1

该特定消息似乎与CLI：https://github.com/aws-amplify/amplify-cli/issues/8363上的GitHub问题有关

我们今天遇到了同样的问题，下面的人帮我们解决了。

解决方案复制到这里：

这个问题是由于MFALambda角色中缺少策略造成的，该角色在#7729中修复。能否尝试将以下策略添加到您的auth cloudformation中，看看这是否解决了问题。需要添加的部分是名为corecocf3573d0_sns_pass_role_policy的策略

# Snippet
MFALambdaRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName:
        Fn::If:
          - ShouldNotCreateEnvResources
          - corecocf3573d0_totp_lambda_role
          - Fn::Join:
              - ''
              - - corecocf3573d0_totp_lambda_role
                - '-'
                - Ref: env
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: corecocf3573d0_totp_pass_role_policy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  Fn::If:
                    - ShouldNotCreateEnvResources
                    - arn:aws:iam:::role/corecocf3573d0_totp_lambda_role
                    - Fn::Join:
                        - ''
                        - - arn:aws:iam:::role/corecocf3573d0_totp_lambda_role
                          - '-'
                          - Ref: env
          # New policy
        - PolicyName: corecocf3573d0_sns_pass_role_policy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'iam:PassRole'
                Resource: !GetAtt SNSRole.Arn