E2507 IAM Resource Policy statement should have Principal or NotPrincipal

richardsonky commented 2 years ago

When cfn-lint is ran against the template aws/FSS-Scanner-Stack.template this error occurs:

This is the resource with the issue, the principal is set to NoValue. Everything appears to work ok, but I think the policy still needs to be adjusted somehow to pass this check:

ScannerQueuePolicy: Type: AWS::SQS::QueuePolicy Properties: PolicyDocument: Version: 2012-10-17 Statement:

Sid: send_message_from_accounts Effect: Allow Principal: !Ref AWS::NoValue Action:
- sqs:SendMessage Resource: !GetAtt ScannerQueue.Arn Queues:
  - !Ref ScannerQueue

trend-jack-c-tang commented 2 years ago

Actually the policy is not required, but it cannot be deleted because when updating stack stuff which our backend's done to the policy will be deleted as well. I'm not in favor of adding extra principals just for passing this check.

felipecosta09 commented 2 years ago

@richardsonky any thoughts on that?

trendmicro / cloudone-filestorage-deployment-templates

E2507 IAM Resource Policy statement should have Principal or NotPrincipal #93