我可以在 CodeBuild 服务角色中使用 aws:PrincipalTag 或 aws:ResourceTag 吗？

如何解决我可以在 CodeBuild 服务角色中使用 aws:PrincipalTag 或 aws:ResourceTag 吗？

我正在尝试设置 CodeBuild 服务角色，以便构建只能访问基于 aws:PrincipalTag/soMetag 或 aws:ResourceTag/soMetag 的特定资源（云监视日志、ECR 等），但是构建因访问被拒绝错误而失败（见下文）。

我像这样指定服务角色：

{
    "Version": "2012-10-17","Statement": [
        {
            "Effect": "Allow","Action": [
                "s3:Getobject","logs:CreateLogStream","ecr:BatchGetimage","logs:CreateLogGroup","logs:PutLogEvents"
            ],"Resource": [
                "arn:aws:ecr:*:111111111:repository/foo-build-images","arn:aws:logs:*:111111111:log-group:${aws:PrincipalTag/organization}_ci_logs:*","arn:aws:logs:*:111111111:log-group:${aws:PrincipalTag/organization}_ci_logs","arn:aws:s3:::foo-buildspecs/*"
            ]
        }
    ]
}

我也试过：

{
    "Version": "2012-10-17","arn:aws:logs:*:111111111:log-group:${aws:ResourceTag/organization}_ci_logs:*","arn:aws:logs:*:111111111:log-group:${aws:ResourceTag/organization}_ci_logs","arn:aws:s3:::foo-buildspecs/*"
            ]
        }
    ]
}

（CodeBuild 项目带有值为“Acme”的“organization”标签）

我从开始构建中得到的错误是：

ACCESS_DENIED: Service role arn:aws:iam::111111111:role/codebuild-ci-role does not allow AWS CodeBuild to create Amazon CloudWatch Logs log streams for build arn:aws:codebuild:us-east-1:111111111:build/acme_test_ci:21dcf438-3f0b-4bad-bf07-b931d3252c54. Error message: User: arn:aws:sts::111111111:assumed-role/codebuild-ci-role/AWSCodeBuild-21dcf438-3f0b-4bad-bf07-b931d3252c54 is not authorized to perform: logs:CreateLogStream on resource: arn:aws:logs:us-east-1:111111111:log-group:Acme_ci_logs:log-stream:test_ci_logs/21dcf438-3f0b-4bad-bf07-b931d3252c54

发生在构建的配置阶段。

似乎当 CodeBuild 承担调用 Cloud Watch Logs 以创建日志流的服务角色时，上下文中既没有 aws:PrincipalTag/organization 也没有 aws:ResourceTag/organization 但我还没有找到文档确认这一点或适当的配置应该是什么。