SAM Doctor

ERROR REFERENCE

Has prohibited field Resource (trust policy)

A role's trust policy contains a Resource element, and trust policies do not take one. Nine times out of ten this is a statement copied from a permissions policy into AssumeRolePolicyDocument.

WHAT IT MEANS

What this error means

IAM has two different policy shapes that look almost identical. Permissions policies say what a principal may do to which resources (Action + Resource). Trust policies say who may assume the role (Action: sts:AssumeRole + Principal) — the role itself is the implicit resource, so an explicit Resource field is rejected outright.

FIX

How to fix it

  1. In the trust policy, replace Resource with Principal: 
    {
  "Effect": "Allow",
  "Principal": { "Service": "lambda.amazonaws.com" },
  "Action": "sts:AssumeRole"
}
  2. Move the resource-scoped statement where it belongs: an inline or managed permissions policy attached to the role (Policies: / ManagedPolicyArns: in CloudFormation), not AssumeRolePolicyDocument.
  3. For OIDC roles, the principal is the provider ARN with a Federated key, plus the sts:AssumeRoleWithWebIdentity action and the repo-scoped conditions.

AUTOMATE THE TRIAGE

Diagnose this automatically

SAM Doctor recognizes the prohibited-field wording (high confidence) and its guidance names the two policy shapes so the fix is a move, not a deletion. Runs locally; no AWS access, no log upload. 

python -m pip install sam-doctor
sam-doctor diagnose deployment.log --format markdown

RELATED