Policy contains a statement with one or more invalid principals

by

When encountering an error stating “policy contains a statement with one or more invalid principals,” it usually means that the policy you are using contains one or more incorrect principal values. The principal value typically represents the entity or entities that are allowed or denied access to certain resources.

Example:

Let’s say you have a policy that grants access to a specific S3 bucket to a certain user or IAM role. However, when defining the principals in the policy, you made a mistake in specifying the principal value. 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/incorrect-role"
      }
    }
  ]
}

In the example above, “arn:aws:iam::123456789012:role/incorrect-role” is an invalid principal value. This could be due to a typo, incorrect formatting, or referring to a non-existent IAM role. As a result, the policy will throw the mentioned error because it contains an invalid principal.

To fix the error, you need to ensure that the principal value is correct. This may involve double-checking the IAM role’s ARN or correcting any syntactical errors in the policy.

Here’s the corrected example using a valid principal value: 

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/correct-role"
      }
    }
  ]
}

In the corrected policy, “arn:aws:iam::123456789012:role/correct-role” is a valid principal value, assuming the IAM role exists and has the appropriate permissions.

Leave a comment