how to allow IAM role to assume another IAM role, via cloudformation?-CodePudding

adding an IAM role via cloudformation , where I want to add a trust policy such that , another IAM role (arn:aws:iam::123456789:role/otherrole) from another aws account can assume my role. but I get an error "Has prohibited field resource ( service: AmazonIdentityManagement; status Code: 400 .....

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  SomeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Resource: arn:aws:iam::123456789:role/otherrole
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
      ...

CodePudding user response：

AssumeRolePolicyDocument do not have Resource. It should be Principal:

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  SomeRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: 
              AWS: arn:aws:iam::123456789:role/otherrole
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
      ...