CloudFormation 条件函数 Fn::Join: 的 yaml 语法问题!Join 指定多个资源 arn 值答案

【问题标题】：Trouble with yaml syntax for CloudFormation condition function Fn::Join: | !Join to specify multiple resource arn valuesCloudFormation 条件函数 Fn::Join: 的 yaml 语法问题!Join 指定多个资源 arn 值
【发布时间】：2021-12-10 16:31:40
【问题描述】：

请求有关 CloudFormation 条件函数 !Join 的 yaml 语法的帮助，以指定多个资源 arn 值。

我无法找出正确的 yaml 语法来生成有效的 json IAM 策略。

任何帮助将不胜感激。

CloudFormation 模板 (yaml)：

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  AdminRoleHaveRLP:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
  TestPolicyName:
    Type: String
    Default: test-service-role-policy
  TestServiceRole1:
    Type: String
    Default: test-service-role1
  TestServiceRole2:
    Type: String
    Default: test-service-role2
Conditions:
  AdminRoleHasRLP: !Equals 
    - 'Yes'
    - !Ref AdminRoleHaveRLP
Resources:
  Policy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Ref TestPolicyName
      Path: /
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ServiceRolePolicy
            Effect: Allow
            Action:
              - 'iam:AttachRolePolicy'
            Resource:
              - !If 
                - AdminRoleHasRLP
                - !Join ['', ['arn:aws:iam::*:role/', !Ref TestServiceRole1,',', 'arn:aws:iam::*:role/', !Ref TestServiceRole2]]
                - 'arn:aws:iam::*:role/*'

当参数 AdminRoleHaveRLP=Yes 时的 IAM 策略输出：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:AttachRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:role/test-service-role1,arn:aws:iam::*:role/test-service-role2"
            ],
            "Effect": "Allow",
            "Sid": "ServiceRolePolicy"
        }
    ]
}

预期的政策输出：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:AttachRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:role/test-service-role1",
                "arn:aws:iam::*:role/test-service-role2"
            ],
            "Effect": "Allow",
            "Sid": "ServiceRolePolicy"
        }
    ]
}

【问题讨论】：

test-service-role1和test-service-role2的定义是什么？

标签： amazon-web-services amazon-cloudformation

【解决方案1】：

使用Sub 而非Join 来定义您的策略的正常且更简单的方法：

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  AdminRoleHaveRLP:
    Type: String
    Default: 'Yes'
    AllowedValues:
      - 'Yes'
      - 'No'
  TestPolicyName:
    Type: String
    Default: test-service-role-policy
  TestServiceRole1:
    Type: String
    Default: test-service-role1
  TestServiceRole2:
    Type: String
    Default: test-service-role2
Conditions:
  AdminRoleHasRLP: !Equals 
    - 'Yes'
    - !Ref AdminRoleHaveRLP
Resources:
  Policy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      ManagedPolicyName: !Ref TestPolicyName
      Path: /
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: ServiceRolePolicy
            Effect: Allow
            Action:
              - 'iam:AttachRolePolicy'
            Resource:
              !If 
                - AdminRoleHasRLP
                - - !Sub 'arn:aws:iam::*:role/${TestServiceRole1}'
                  - !Sub 'arn:aws:iam::*:role/${TestServiceRole2}'
                - 'arn:aws:iam::*:role/*'

【讨论】：

那行得通，我以为我已经尝试过了，但一定已经看过了。感谢您的帮助！