title: Getting Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument for while creating Cloudformation stack
body: <p>I am trying to create cloud formation template for ECR and ELB, I pushed my image to ECR separately. In Dockerrun.json, I referred to my image like this &quot;image&quot;: &quot;.dkr.ecr.ap-south-1.amazonaws.com/*:latest&quot;. So I need to provide IAM permission for both ELB and ECR. But there is some issue with IAM part in this template. Getting this error while creating the stack. Is any fixes is required?</p>
  <pre><code>Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: 8b9b3f05-51c9-41e1-b008-c59aa319c086; Proxy: null)
  </code></pre>
  <pre><code>Resources:
    sampleApplication:
      Type: AWS::ElasticBeanstalk::Application
      Properties:
        Description: AWS Elastic Beanstalk Sample Application
    sampleApplicationVersion:
      Type: AWS::ElasticBeanstalk::ApplicationVersion
      Properties:
        ApplicationName:
          Ref: sampleApplication
        Description: AWS ElasticBeanstalk Sample Application Version
        SourceBundle:
          S3Bucket: !Sub &quot;elasticbeanstalk-ap-south-1-182107200133&quot;
          S3Key: TravelTouch/Dockerrun.aws.json
    MyRepository:
      Type: AWS::ECR::Repository
      Properties:
        RepositoryName: &quot;182107200133.dkr.ecr.ap-south-1.amazonaws.com/socialbox&quot;
    sampleConfigurationTemplate:
      Type: AWS::ElasticBeanstalk::ConfigurationTemplate
      Properties:
        ApplicationName:
          Ref: sampleApplication
        Description: AWS ElasticBeanstalk Sample Configuration Template
        OptionSettings:
          - Namespace: aws:autoscaling:asg
            OptionName: MinSize
            Value: '2'
          - Namespace: aws:autoscaling:asg
            OptionName: MaxSize
            Value: '6'
          - Namespace: aws:elasticbeanstalk:environment
            OptionName: EnvironmentType
            Value: LoadBalanced
          - Namespace: aws:autoscaling:launchconfiguration
            OptionName: IamInstanceProfile
            Value: !Ref MyInstanceProfile
        SolutionStackName: 64bit Amazon Linux 2018.03 v2.26.0 running Multi-container Docker 19.03.13-ce (Generic)
  
    sampleEnvironment:
      Type: AWS::ElasticBeanstalk::Environment
      Properties:
        ApplicationName:
          Ref: sampleApplication
        Description: AWS ElasticBeanstalk Sample Environment
        TemplateName:
          Ref: sampleConfigurationTemplate
        VersionLabel:
          Ref: sampleApplicationVersion
  
    MyInstanceRole:
      Type: AWS::IAM::Role
      Properties:
        AssumeRolePolicyDocument:
          Version: 2012-10-17
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - ec2.amazonaws.com
              Action:
                - sts:AssumeRole
        Description: Beanstalk EC2 role
        ManagedPolicyArns:
          - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
          - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
          - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
        Policies:
          - PolicyName: AllowGetAuthorizationToken
            PolicyDocument: |
              {
                &quot;Version&quot;: &quot;2012-10-17&quot;,
                &quot;Statement&quot;: [
                    {
                        &quot;Sid&quot;: &quot;ECSAccess&quot;,
                        &quot;Effect&quot;: &quot;Allow&quot;,
                        &quot;Action&quot;: [
                            &quot;ecr:GetAuthorizationToken&quot;,
                        ],
                        &quot;Resource&quot;: &quot;*&quot;
                    }
                ]
              }  
  
    MyInstanceProfile:
      Type: AWS::IAM::InstanceProfile
      Properties:
        Roles:
          - !Ref MyInstanceRole
  </code></pre>