AWS :: KSM :: Keyを作成するときにMalformedPolicyDocumentExceptionが発生する

Question

S3サービスで使用するKSMキーを作成しようとしていますが、MalformedPolicyDocument例外が発生します。ここにリソースがあります：

"CustomerMasterKey":{ 
    "Type" : "AWS::KMS::Key", 
    "Condition" : "EnableEncryption", 
    "Properties" : { 
    "Description" : "Client Master Key used to encrypt data", 
    "Enabled" : true, 
    "EnableKeyRotation" : true, 
    "KeyPolicy" : 
    { 
     "Version": "2012-10-17", 
     "Id": {"Fn::Join": ["",["Key","Policy",{"Ref": "CustomerParam"}]]}, 
     "Statement": 
     [{ 
     "Sid": "Allow access for Key Administrators", 
     "Effect": "Allow", 
     "Principal": { 
     "AWS": {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},"moimeco"]]} 
     }, 
     "Action": [ 
     "kms:Create*", 
     "kms:Describe*", 
     "kms:Enable*", 
     "kms:List*", 
     "kms:Put*", 
     "kms:Update*", 
     "kms:Revoke*", 
     "kms:Disable*", 
     "kms:Get*", 
     "kms:Delete*", 
     "kms:TagResource", 
     "kms:UntagResource", 
     "kms:ScheduleKeyDeletion", 
     "kms:CancelKeyDeletion" 
     ], 
     "Resource": "*" 
     }, 
     { 
     "Sid": "Allow use of the key", 
     "Effect": "Allow", 
     "Principal": { 
     "AWS": 
     [ 
      {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"}, {"Ref": "CustomerParam"}]]}, 
      {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},"userprod"]]} 
     ] 
     }, 
     "Action": [ 
     "kms:Encrypt", 
     "kms:Decrypt", 
     "kms:ReEncrypt*", 
     "kms:GenerateDataKey*", 
     "kms:DescribeKey" 
     ], 
     "Resource": "*", 
     "Condition": { 
     "StringEquals": { 
      "kms:ViaService": "s3.eu-west-1.amazonaws.com" 
     } 
     } 
     }] 
    } 
    } 
}, 

私はどこがエラーであるか分かりませんが、それはすべていいです。どんな考えですか？定義されたプリンシパルがARNSに評価しない

"CustomerMasterKey":{ 
     "Type" : "AWS::KMS::Key", 
     "Properties" : { 
     "Description" : "A sample key", 
     "KeyPolicy" : { 
      "Version": "2012-10-17", 
      "Id": {"Fn::Join": ["-",["Key","Policy",{"Ref": "CustomerParam"}]]}, 
      "Statement": [ 
      { 
      "Sid": "Enable IAM User Permissions", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": {"Fn::Join": ["", ["arn:aws:iam::",{"Ref": "AWS::AccountId"},":root"]]} 
      }, 
      "Action": "kms:*", 
      "Resource": "*" 
      }, 
      { 
      "Sid": "Allow administration of the key", 
      "Effect": "Allow", 
      "Principal": { "AWS": {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},":user/","userprod"]]} }, 
      "Action": [ 
       "kms:Create*", 
       "kms:Describe*", 
       "kms:Enable*", 
       "kms:List*", 
       "kms:Put*", 
       "kms:Update*", 
       "kms:Revoke*", 
       "kms:Disable*", 
       "kms:Get*", 
       "kms:Delete*", 
       "kms:ScheduleKeyDeletion", 
       "kms:CancelKeyDeletion" 
      ], 
      "Resource": "*" 
      }, 
      { 
      "Sid": "Allow use of the key", 
      "Effect": "Allow", 
      "Principal": { "AWS": [{"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},":user/",{"Ref": "CustomerParam"}]]}, 
            {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},":user/","moimeco"]]}] 
         }, 
      "Action": [ 
       "kms:Encrypt", 
       "kms:Decrypt", 
       "kms:ReEncrypt*", 
       "kms:GenerateDataKey*", 
       "kms:DescribeKey" 
      ], 
      "Resource": "*" 
      }, 
      { 
      "Sid": "Allow attachment of persistent resources", 
      "Effect": "Allow", 
      "Principal": { 
       "AWS": {"Fn::Join": ["",["arn:aws:iam::",{"Ref": "AWS::AccountId"},":user/",{"Ref": "CustomerParam"}]]} 
      }, 
      "Action": [ 
       "kms:CreateGrant", 
       "kms:ListGrants", 
       "kms:RevokeGrant" 
      ], 
      "Resource": "*", 
      "Condition": {"Bool": {"kms:GrantIsForAWSResource": "true"}} 
      } 
     ] 
     } 
     } 
    }, 

Answer 1

：

::EDIT::

このコードは同じエラーを与えています。

最初の校長は、と評価されます：

"AWS": "arn:aws:iam::11111111moimeco" 

ユーザーの有効なARNは、次のようになります。

"arn:aws:iam::1111111:user/username" 

また、あなたはあなたのプリンシパルにrootユーザーを含める必要があります。

そうしないと、AWSはキーをまったく作成させません。この背後にある理由はここに記述されている：

AWS Key policies「AWSアカウントへのアクセスを可能にし、IAMポリシーを有効にします」