Let's say something like this is being returned when attempting to create an IAM (Identity and Access Management) Role using the aws iam create-role command.

~]$ aws iam create-role --role-name my-role --assume-role-policy-document file://my.json

An error occurred (MalformedPolicyDocument) when calling the CreateRole operation: Has prohibited field Resource

Notice in this example that the issue is with "Resource". Looking at my.json, there is a "Resource" key.

]$ cat my.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:PutMetricFilter",
                "logs:PutRetentionPolicy"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

It's important to recognize that almost always, a Role will have two Policies.

• Trust Relationship
• Permission Policy

Check out my article Permission Policy vs Trust Policy

The aws iam create-role command expects a JSON file like this, almost always with the sts:AssumeRole action. For more details on assume role, check out my articles Assume Role or Switch Role using the AWS CLI, Assume Role or Switch Role using Python boto3 and Assume Role or Switch Role using Terraform.

{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Effect": "Allow",
          "Principal": { "AWS": "arn:aws:iam::123456789012:root" },
          "Action": "sts:AssumeRole"
      }
  ]
}

After creating the role with the sts:AssumeRole action, you can then use the aws iam attach-role-policy command can be used to attach a Permission Policy to the Role

aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --role-name my-role