(MalformedPolicyDocument) AssumeRole policy may only specify STS AssumeRole actions

Question

This question has been answered here but it didn't solve my problem.

I get the An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: AssumeRole policy may only specify STS AssumeRole actions when I try to call aws iam create-role --role-name AutoscalingRole-Name --assume-role-policy-document file://./IAM_Trust_Policy.json

If my IAM_Trust_Policy.json contains only this code:

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {
            "Service": [
                "ec2.amazonaws.com"
            ]   
        },
        "Action": "sts:AssumeRole"
    }
}

It's working like a charm. But I needed something more, I'm creating an autoscaling role and I have a policy with these requirements:

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Allow",
        "Principal": {
            "Service": [
                "ec2.amazonaws.com",
                "autoscaling.amazonaws.com"
            ]   
        },
        "Action": [
            "autoscaling:DescribeAutoScalingGroups",
            "autoscaling:DescribeAutoScalingInstances",
            "autoscaling:DescribeLaunchConfigurations",
            "autoscaling:DescribeTags",
            "autoscaling:SetDesiredCapacity",
            "autoscaling:TerminateInstanceInAutoScalingGroup",
            "ec2:DescribeLaunchTemplateVersions"
        ]
    }
}

And for some reason I get the An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: AssumeRole policy may only specify STS AssumeRole actions

Can anyone see where I'm wrong? Thanks

Answer 1

As @luk2302 commented, you are mixing up two policy types. Both are required for your Role to be useful:

Trust Policy: whom you allow to assume the role

• This is your first policy document
• Principal is required - this is whom you allow
• Use this as the AssumeRolePolicyDocument parameter in CreateRole .

Access/Permissions Policies: the permissions the role will have

• This is your second policy document
• Principal is not allowed - makes no sense here
• There are two ways to attach these permissions to your role (aka Identity-based Policies):
  • As a standalone Managed Policy with AttachRolePolicy
  • Or as an Inline Policy embedded in your role with PutRolePolicy

In other words, remove the Principal from your second policy document and call PutRolePolicy to embed it with your role.