Resource handler returned message: “The provided policy document does not meet the requirements of the specified policy type.”
Error message for AWS CloudFormation with a Service Control Policy is *Not Helpful* (or any IAM-like policy)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Bugs | AWS Security | Secure Code
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I’m trying to deploy a service control policy with CloudFormation. This should be straightforward. I got the policy working without an fn::ImportValue that references a value in another stack. I cannot find any documentation saying this won’t work. This is standard CloudFormation so I presume it is OK.
Whenever I replace the ARN with the Fn::ImportValue I get this error which is completely unhelpful:
“The provided policy document does not meet the requirements of the specified policy type.”
This error says nothing. I am clearly adding a valid policy type. I’ve already deployed it correctly with an ARN. The problem has to do with the FN::ImportValue statement. It seems like whatever code is parsing the policy could figure out the problem with my statement and tell me how to fix it with a more helpful error message.
Fn::ImportValue and ImportValue in policy documents seem especially tricky and would be helpful if AWS provided more examples of pulling ARNs from outputs and including them in a policy. Beyond that, the error message should be useful with a line number and syntax problem.
I finally just gave up on the whole idea of using an import and instead formulated my ARN with the AWS::AccountId and hardcoded it in the template as I spent entirely too long on this.
Then, I got the same error when I tried to add two additional actions to the list of actions in my policy.
I don’t know what the first problem was with my ImportValue statement (yet) but in the second case I simply forgot to put brackets around my list when I turned a single string into multiple actions. It seems like this is a reasonable thing for a CloudFormation policy parser to decipher and provide an appropriate error message.
Then, I was missing a comma after the brackets I added. This also seems like something a parser could easily decipher.
I happen to instantly see my problem in those last two cases after years of CloudFormation. Those new to CloudFormation might not spot it so quickly and waste a lot of time trying to resolve the issue because they might not realize that the syntax is different when you add one element or a list of elements. [Why? A list of one element should work and would be consistent in all cases and example code.]
Be kind to customers. Provide a better policy parser that presents better error messages for policies of any kind in AWS when deploying with CloudFormation. I have spent hours and days and probably months of my life on issues like this.
#awswishlist
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab