Getting Cloudformation error: Embedded stack was not successfully created

Question 1

I’ve made a parent (nested) stack template that references 4 child templates. When I launch the stack through aws cloudformation create-stack, I get the following error for the parent stack:

Embedded stack AlignmentLambdaFunction was not successfully created: The following resource(s) failed to create: [CloudspanLambdaFunction, HaploLambdaExecutionRole, AlignmentLambdaExecutionRole].

And I get this error within one of the nested stacks that was getting created from the parent: Policy contains a statement with one or more invalid principals (for MasterGCPStorageKey (which is a resource in the Lambda child above)

I don’t understand the source of the error. I thought maybe it was because of needing a DependsOn for the ExecutionRoles, but that didn’t resolve the error.

Parent Stack:

AWSTemplateFormatVersion: "2010-09-09"
Description: "Master template for wgs-pipeline. Calls to other stack templates."
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
  AlignmentLambdaFuncS3KeyName:
    Type: String
  AlignmentLambdaFuncModuleName:
    Type: String
  HaploLambdaFuncS3BucketName:
    Type: String
  HaploLambdaFuncS3KeyName:
    Type: String
  HaploLambdaFuncModuleName:
    Type: String
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: 'VPC'
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: 
        Ref: 'VPC'
      InternetGatewayId: 
        Ref: 'InternetGateway'
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Security Group for instances launched in the VPC by Batch
      VpcId: 
        Ref: 'VPC'
  StepFunctionsActivitiesInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 128.218.0.0/16
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/24
      VpcId: 
        Ref: 'VPC'
      AvailabilityZone: 
        Ref: GPCESubnetAZ1
      MapPublicIpOnLaunch: 'True'
    DependsOn: VPC

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: 
        Ref: 'InternetGateway'
    DependsOn:
      - RouteTable
      - InternetGateway
  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      SubnetId: 
        Ref: 'Subnet'
    DependsOn:
      - RouteTable
      - Subnet

  # Beginning of reference to child stacks

  ClouspanLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        CloudspanLambdaFuncS3BucketName: 
          Ref: CloudspanLambdaFuncS3BucketName
        CloudspanLambdaFuncS3KeyName: 
          Ref: CloudspanLambdaFuncS3KeyName
        CloudspanLambdaFuncModuleName: 
          Ref: CloudspanLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  AlignmentLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        AlignmentLambdaFuncS3BucketName: 
          Ref: AlignmentLambdaFuncS3BucketName
        AlignmentLambdaFuncS3KeyName: 
          Ref: AlignmentLambdaFuncS3KeyName
        AlignmentLambdaFuncModuleName: 
          Ref: AlignmentLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  HaploLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        HaploLambdaFuncS3BucketName: 
          Ref: HaploLambdaFuncS3BucketName
        HaploLambdaFuncS3KeyName: 
          Ref: HaploLambdaFuncS3KeyName
        HaploLambdaFuncModuleName: 
          Ref: HaploLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

AWSTemplateFormatVersion: "2010-09-09"

Description: "Master template for wgs-pipeline. Calls to other stack templates."

Parameters:

CloudspanLambdaFuncS3BucketName:

Type: String

CloudspanLambdaFuncS3KeyName:

Default: 'sfn.deployable.zip'

Type: String

CloudspanLambdaFuncModuleName:

Default: 'cloudspan'

Type: String

AlignmentLambdaFuncS3BucketName:

Type: String

AlignmentLambdaFuncS3KeyName:

Type: String

AlignmentLambdaFuncModuleName:

Type: String

HaploLambdaFuncS3BucketName:

Type: String

HaploLambdaFuncS3KeyName:

Type: String

HaploLambdaFuncModuleName:

Type: String

KMSAdminUserARN:

Type: String

KMSEndUserARN:

Type: String

Resources:

VPC:

Type: AWS::EC2::VPC

Properties:

CidrBlock: 10.0.0.0/16

InternetGateway:

Type: AWS::EC2::InternetGateway

RouteTable:

Type: AWS::EC2::RouteTable

Properties:

VpcId:

Ref: 'VPC'

VPCGatewayAttachment:

Type: AWS::EC2::VPCGatewayAttachment

Properties:

VpcId:

Ref: 'VPC'

InternetGatewayId:

Ref: 'InternetGateway'

SecurityGroup:

Type: AWS::EC2::SecurityGroup

Properties:

GroupDescription: EC2 Security Group for instances launched in the VPC by Batch

VpcId:

Ref: 'VPC'

StepFunctionsActivitiesInstanceSecurityGroup:

Type: AWS::EC2::SecurityGroup

Properties:

GroupDescription: Allow http to client host

VpcId:

Ref: VPC

SecurityGroupIngress:

- IpProtocol: tcp

FromPort: '22'

ToPort: '22'

CidrIp: 128.218.0.0/16

Subnet:

Type: AWS::EC2::Subnet

Properties:

CidrBlock: 10.0.0.0/24

VpcId:

Ref: 'VPC'

AvailabilityZone:

Ref: GPCESubnetAZ1

MapPublicIpOnLaunch: 'True'

DependsOn: VPC

Route:

Type: AWS::EC2::Route

Properties:

RouteTableId:

Ref: 'RouteTable'

DestinationCidrBlock: 0.0.0.0/0

GatewayId:

Ref: 'InternetGateway'

DependsOn:

- RouteTable

- InternetGateway

SubnetRouteTableAssociation:

Type: AWS::EC2::SubnetRouteTableAssociation

Properties:

RouteTableId:

Ref: 'RouteTable'

SubnetId:

Ref: 'Subnet'

DependsOn:

- RouteTable

- Subnet

# Beginning of reference to child stacks

ClouspanLambdaFunction:

Type: "AWS::CloudFormation::Stack"

Properties:

Parameters:

CloudspanLambdaFuncS3BucketName:

Ref: CloudspanLambdaFuncS3BucketName

CloudspanLambdaFuncS3KeyName:

Ref: CloudspanLambdaFuncS3KeyName

CloudspanLambdaFuncModuleName:

Ref: CloudspanLambdaFuncModuleName

KMSAdminUserARN:

Ref: KMSAdminUserARN

KMSEndUserARN:

Ref: KMSEndUserARN

TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml

TimeoutInMinutes: 1

AlignmentLambdaFunction:

Type: "AWS::CloudFormation::Stack"

Properties:

Parameters:

AlignmentLambdaFuncS3BucketName:

Ref: AlignmentLambdaFuncS3BucketName

AlignmentLambdaFuncS3KeyName:

Ref: AlignmentLambdaFuncS3KeyName

AlignmentLambdaFuncModuleName:

Ref: AlignmentLambdaFuncModuleName

KMSAdminUserARN:

Ref: KMSAdminUserARN

KMSEndUserARN:

Ref: KMSEndUserARN

TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml

TimeoutInMinutes: 1

HaploLambdaFunction:

Type: "AWS::CloudFormation::Stack"

Properties:

Parameters:

HaploLambdaFuncS3BucketName:

Ref: HaploLambdaFuncS3BucketName

HaploLambdaFuncS3KeyName:

Ref: HaploLambdaFuncS3KeyName

HaploLambdaFuncModuleName:

Ref: HaploLambdaFuncModuleName

KMSAdminUserARN:

Ref: KMSAdminUserARN

KMSEndUserARN:

Ref: KMSEndUserARN

TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml

TimeoutInMinutes: 1

Lambda Child Stack (relevant for error):

AWSTemplateFormatVersion: '2010-09-09'
Description: lambda function and execution role stack.
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  AlignmentLambdaFuncS3KeyName:
    Type: String
    Default: 'alignment_processing.deployable.zip'
  AlignmentLambdaFuncModuleName:
    Type: String
    Default: 'alignment_processing'
  HaploLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  HaploLambdaFuncS3KeyName:
    Type: String
    Default: 'sentieon_haplotyper.deployable.zip'
  HaploLambdaFuncModuleName:
    Type: String
    Default: 'sentieon_haplotyper'
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String


Resources:

  CloudspanLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: CloudspanLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: CloudspanLambdaFuncS3BucketName
        S3Key:
          Ref: CloudspanLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: CloudspanLambdaExecutionRole

  AlignmentLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: AlignmentLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ AlignmentLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: AlignmentLambdaFuncS3BucketName
        S3Key:
          Ref: AlignmentLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: AlignmentLambdaExecutionRole

  HaploLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: HaploLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ HaploLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: HaploLambdaFuncS3BucketName
        S3Key:
          Ref: HaploLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: HaploLambdaExecutionRole


  CloudspanLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*


  AlignmentLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  HaploLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  MasterGCPStorageKey:
    Type: "AWS::KMS::Key"
    Properties:
      Description: Symmetric Master Key for GCP Storage Credentials off-line encryption/on-line decryption protocol
      Enabled: True
      EnableKeyRotation: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
        - Sid: "Allow Lambda Excution Role access to GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of CloudspanLambdaExecutionRole
            AWS:
              Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
          Action:
            - kms:Decrypt
            - kms:DescribeKey
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow Administrator to admin the GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of the KMS admin IAM user
            AWS:
              Ref: KMSAdminUserARN
          Action:
            - "kms:Create*"
            - "kms:Describe*"
            - "kms:Enable*"
            - "kms:List*"
            - "kms:Put*"
            - "kms:Update*"
            - "kms:Revoke*"
            - "kms:Disable*"
            - "kms:Get*"
            - "kms:Delete*"
            - "kms:TagResource"
            - "kms:UntagResource"
            - "kms:ScheduleKeyDeletion"
            - "kms:CancelKeyDeletion"
            - "kms:Encrypt"
            - "kms:Decrypt"
            - "kms:ReEncrypt"
            - "kms:GenerateDataKey*"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow End User to encrypt the GCP Storage creds"
          Effect: "Allow"
          Principal:
            # ARN of the KMS IAM end user
            AWS:
              Ref: KMSEndUserARN
          Action:
            - "kms:Encrypt"
            - "kms:ReEncrypt"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
    DependsOn: CloudspanLambdaExecutionRole

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

AWSTemplateFormatVersion: '2010-09-09'

Description: lambda function and execution role stack.

Parameters:

CloudspanLambdaFuncS3BucketName:

Type: String

Default: 'claudia-test-transfer'

CloudspanLambdaFuncS3KeyName:

Default: 'sfn.deployable.zip'

Type: String

CloudspanLambdaFuncModuleName:

Default: 'cloudspan'

Type: String

AlignmentLambdaFuncS3BucketName:

Type: String

Default: 'claudia-test-transfer'

AlignmentLambdaFuncS3KeyName:

Type: String

Default: 'alignment_processing.deployable.zip'

AlignmentLambdaFuncModuleName:

Type: String

Default: 'alignment_processing'

HaploLambdaFuncS3BucketName:

Type: String

Default: 'claudia-test-transfer'

HaploLambdaFuncS3KeyName:

Type: String

Default: 'sentieon_haplotyper.deployable.zip'

HaploLambdaFuncModuleName:

Type: String

Default: 'sentieon_haplotyper'

KMSAdminUserARN:

Type: String

KMSEndUserARN:

Type: String

Resources:

CloudspanLambdaFunction:

Type: "AWS::Lambda::Function"

Properties:

Handler:

Fn::Join: [ ".", [ Ref: CloudspanLambdaFuncModuleName, "handler"] ]

Role:

Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]

Code:

S3Bucket:

Ref: CloudspanLambdaFuncS3BucketName

S3Key:

Ref: CloudspanLambdaFuncS3KeyName

Runtime: "python3.6"

Timeout: "60"

DependsOn: CloudspanLambdaExecutionRole

AlignmentLambdaFunction:

Type: "AWS::Lambda::Function"

Properties:

Handler:

Fn::Join: [ ".", [ Ref: AlignmentLambdaFuncModuleName, "handler"] ]

Role:

Fn::GetAtt: [ AlignmentLambdaExecutionRole, Arn ]

Code:

S3Bucket:

Ref: AlignmentLambdaFuncS3BucketName

S3Key:

Ref: AlignmentLambdaFuncS3KeyName

Runtime: "python3.6"

Timeout: "60"

DependsOn: AlignmentLambdaExecutionRole

HaploLambdaFunction:

Type: "AWS::Lambda::Function"

Properties:

Handler:

Fn::Join: [ ".", [ Ref: HaploLambdaFuncModuleName, "handler"] ]

Role:

Fn::GetAtt: [ HaploLambdaExecutionRole, Arn ]

Code:

S3Bucket:

Ref: HaploLambdaFuncS3BucketName

S3Key:

Ref: HaploLambdaFuncS3KeyName

Runtime: "python3.6"

Timeout: "60"

DependsOn: HaploLambdaExecutionRole

CloudspanLambdaExecutionRole:

Type: "AWS::IAM::Role"

Properties:

AssumeRolePolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Principal:

Service: lambda.amazonaws.com

Action: "sts:AssumeRole"

Policies:

- PolicyName: CanListBuckets

PolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Action:

- "s3:GetBucketLocation"

- "s3:ListAllMyBuckets"

Resource: "arn:aws:s3:::*"

- PolicyName: CanLog

PolicyDocument:

Version: '2012-10-17'

Statement:

- Effect: Allow

Action:

- logs:*

Resource: arn:aws:logs:*:*:*

AlignmentLambdaExecutionRole:

Type: "AWS::IAM::Role"

Properties:

AssumeRolePolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Principal:

Service: lambda.amazonaws.com

Action: "sts:AssumeRole"

Policies:

- PolicyName: CanListBuckets

PolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Action:

- "s3:GetBucketLocation"

- "s3:ListAllMyBuckets"

Resource: "arn:aws:s3:::*"

- PolicyName: CanCallBatch

PolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Action:

- "batch:*"

Resource: "*"

- PolicyName: CanLog

PolicyDocument:

Version: '2012-10-17'

Statement:

- Effect: Allow

Action:

- logs:*

Resource: arn:aws:logs:*:*:*

HaploLambdaExecutionRole:

Type: "AWS::IAM::Role"

Properties:

AssumeRolePolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Principal:

Service: lambda.amazonaws.com

Action: "sts:AssumeRole"

Policies:

- PolicyName: CanListBuckets

PolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Action:

- "s3:GetBucketLocation"

- "s3:ListAllMyBuckets"

Resource: "arn:aws:s3:::*"

- PolicyName: CanCallBatch

PolicyDocument:

Version: "2012-10-17"

Statement:

- Effect: Allow

Action:

- "batch:*"

Resource: "*"

- PolicyName: CanLog

PolicyDocument:

Version: '2012-10-17'

Statement:

- Effect: Allow

Action:

- logs:*

Resource: arn:aws:logs:*:*:*

MasterGCPStorageKey:

Type: "AWS::KMS::Key"

Properties:

Description: Symmetric Master Key for GCP Storage Credentials off-line encryption/on-line decryption protocol

Enabled: True

EnableKeyRotation: True

KeyPolicy:

Version: "2012-10-17"

Statement:

- Sid: "Allow Lambda Excution Role access to GCP Storage decryption key"

Effect: "Allow"

Principal:

# ARN of CloudspanLambdaExecutionRole

AWS:

Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]

Action:

- kms:Decrypt

- kms:DescribeKey

# in this context "*" means "this" CMK

Resource: "*"

- Sid: "Allow Administrator to admin the GCP Storage decryption key"

Effect: "Allow"

Principal:

# ARN of the KMS admin IAM user

AWS:

Ref: KMSAdminUserARN

Action:

- "kms:Create*"

- "kms:Describe*"

- "kms:Enable*"

- "kms:List*"

- "kms:Put*"

- "kms:Update*"

- "kms:Revoke*"

- "kms:Disable*"

- "kms:Get*"

- "kms:Delete*"

- "kms:TagResource"

- "kms:UntagResource"

- "kms:ScheduleKeyDeletion"

- "kms:CancelKeyDeletion"

- "kms:Encrypt"

- "kms:Decrypt"

- "kms:ReEncrypt"

- "kms:GenerateDataKey*"

- "kms:DescribeKey"

# in this context "*" means "this" CMK

Resource: "*"

- Sid: "Allow End User to encrypt the GCP Storage creds"

Effect: "Allow"

Principal:

# ARN of the KMS IAM end user

AWS:

Ref: KMSEndUserARN

Action:

- "kms:Encrypt"

- "kms:ReEncrypt"

- "kms:DescribeKey"

# in this context "*" means "this" CMK

Resource: "*"

DependsOn: CloudspanLambdaExecutionRole

Question 2

I also was getting the following error after re-deploying a CloudFormation stack I had removed (via Serverless):

We encountered the following errors while processing your request:
Policy contains a statement with one or more invalid principals.

1

2

3

We encountered the following errors while processing your request:

Policy contains a statement with one or more invalid principals.

In my case, the original role which was assigned to my KMS encryption key was removed. KMS still keeps a reference to the removed role, and apparently adding a newly created role of the same type creates this error.

I solved this by simply removing the old reference to the removed role, under IAM > Encryption Keys > YOUR_KEY_NAME > Key Policy > Key Users

Getting Cloudformation error: Embedded stack was not successfully created

Question:

Answer:

Leave a Reply Cancel reply