调用CreateStack操作时发生错误（AccessDenied）：

An error occurred (AccessDenied) when calling the CreateStack operation: User: arn:aws:iam::812520856627:user/dimitris is not authorized to perform: cloudformation:CreateStack on resource: arn:aws:cloudformation:us-west-2:812520856627:stack/blog-stage/*

我尝试在命令上运行它：

aws cloudformation create-stack --stack-name blog-stage --template-body file://$PWD/stack.yml --profile demo --region us-west-2

Resources:
  AppNode:
    Type: AWS::EC2::Instance
    Properties:
        InstanceType: t2.micro
        ImageId: ami-0c579621aaac8bade
        KeyName: jimapos
        SecurityGroups:
          - !Ref AppNodeSG
  AppNodeSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
        GroupDescription: for the app nodes that allow ssh, http and docker ports
        SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          CidrIp: 0.0.0.0/0
          - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: 0.0.0.0/0

您正在尝试创建堆栈User dimitris无权执行cloudformation:CreateStack

To 分配权限 https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_change-permissions.html给用户转到https://console.aws.amazon.com/iam/home#/home https://console.aws.amazon.com/iam/home#/home-> 用户 -> 选择用户 -> 添加权限

尝试使用用户 dimitries 添加此策略。

示例 授予创建和查看堆栈操作的示例策略

{
    "Version":"2012-10-17",
    "Statement":[{
        "Effect":"Allow",
        "Action":[
            "cloudformation:CreateStack",
            "cloudformation:DescribeStacks",
            "cloudformation:DescribeStackEvents",
            "cloudformation:DescribeStackResources",
            "cloudformation:GetTemplate",
            "cloudformation:ValidateTemplate"  
        ],
        "Resource":"*"
    }]
}

你可以检查这个link https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-iam-template.html自定义或重新坚持特定资源的策略。

您可以创建自定义策略，也可以附加以下现有策略。