IAM Policy Parsing Issue

Question

Hi AWS, I am creating an IAM policy using CloudFormation. This is one of the sample block in the policy code.

```
- Effect: Deny
  Sid: S3Deny
  Action:
    - s3:Get*
    - s3:List*
  NotResource: !Split
    - ","
    - !Ref S3NotResource
```

The syntax and indentation looks good as I am using CloudFormation Linter to find any syntax issues, warnings, errors etc. and it has not detected anything but while deploying it through CloudFormation I am getting this error:

**resource handler returned message: "the policy failed legacy parsing (service: iam, status code: 400, request id: ~~3c569005-7172-4f1x-836x-b493d8825947~~)" (requesttoken: ~~cb6xxxx-32a7-7e08-761x-542162288xx1~~, handlererrorcode: invalidrequest)**

Please help me in spotting the issue as it is very annoying.

Answer

It seems you have 2 “Effects”? Try to change the second one with Actions

Answer

Hello.

It looks like there is "Effect" in "Effect", but I think it is actually "Action".  
```
- Effect: Deny
  Sid: S3Deny
  Action:
    - s3:Get*
    - s3:List*
  NotResource: !Split
    - ","
    - !Ref S3NotResource
```

Answer

The error was spotted. One of the ARNs in the parameter list was wrong.

Thanks for the help.

IAM Policy Parsing Issue

Relevant content