IAM Role - AssumeRolepolicy contained an invalid principal: "STAR":"*"

Question

So, I've been trying to write an IAM Role for CodeBuild and CodePipeline in AWS CDK.

I need it to be public so I can reference them in their own declaration.

I've also tried to generate a simple CloudFormation template out of my code and had no success in uploading it. Had the same error.

AssumeRolepolicy contained an invalid principal: "STAR":"*"

const codeBuildRoleName = `${parameters.environment}CodeBuildRole`;
const codeBuildRole = new Role(this, codeBuildRoleName, {
  assumedBy: new AnyPrincipal(),
  roleName: codeBuildRoleName,
});

const codeBuildRolePolicy = `${parameters.environment}CodeBuildRolePolicy`;
codeBuildRole.attachInlinePolicy(new Policy(this, codeBuildRolePolicy , {
  statements: [
    new PolicyStatement({
      effect: Effect.ALLOW,
      resources: ['*'],
      actions: ['iam:PassRole']
    }),
    new PolicyStatement({
      effect: Effect.ALLOW,
      resources: ['*'],
      actions: ['codebuild:*']
    }),
    new PolicyStatement({
      effect: Effect.ALLOW,
      resources: ['*'],
      actions: [
        'logs:FilterLogEvents',
        'logs:GetLogEvents',
        'logs:CreateLogStream',
        'logs:CreateLogGroup',
        'logs:PutLogEvents',
      ]
    }),
    new PolicyStatement({
      effect: Effect.ALLOW,
      resources: ['*'],
      actions: [
        'apigateway:PATCH',
        'apigateway:GET',
        'apigateway:POST',
        'iam:*',
        'cloudformation:*',
        's3:*',
        'cognito-idp:*',
      ]
    })
  ]
}));

This is the code, and I've been getting this.

AssumeRolepolicy contained an invalid principal: "STAR":"*"

And I can't deploy anything.

How does policy created on AWS looks lik – Arun Kamalanathan Jan 06 '20 at 20:16 — Arun Kamalanathan, Jan 06 '20 at 20:16

score -1 · Answer 1 · answered Jan 06 '20 at 22:50

When you create the Role, try passing a ServicePrincipal instead of AnyPrincipal like so:

const codeBuildRole = new Role(this, codeBuildRoleName, {
  assumedBy: new ServicePrincipal(service: "codebuild.amazonaws.com"),
  roleName: codeBuildRoleName,
});

I'm not in a position of testing this right now, but I think this should fix the issue.

IAM Role - AssumeRolepolicy contained an invalid principal: "STAR":"*"

1 Answers1