模板包含错误。：[/Resources/CloudTrail/Type/EventSelectors] AWS CloudFormation CloudTrail 中的模板中不允许使用“null”值答案

【问题标题】：Template contains errors.: [/Resources/CloudTrail/Type/EventSelectors] 'null' values are not allowed in templates in AWS CloudFormation CloudTrail模板包含错误。：[/Resources/CloudTrail/Type/EventSelectors] AWS CloudFormation CloudTrail 中的模板中不允许使用“null”值
【发布时间】：2023-04-02 11:09:01
【问题描述】：

我在尝试验证我的 cloudformation 模板时收到“模板包含错误。：[/Resources/CloudTrail/Type/EventSelectors] 'null' values are not allowed in templates”错误。

"Conditions":
  "S3Enabled":
    "Fn::Equals":
    - "IsS3Enabled"
    - "true"
"Parameters":
  "IsS3Enabled":
    "AllowedValues":
    - "true"
    - "false"
    "Default": "true"
    "Description": "whether you want cloudtrail enabled for S3"
    "Type": "String"
  "LambdaArns":
    "Default": "arn:aws:lambda"
    "Description": "The lambda arns of cloudtrail event selectors"
    "Type": "CommaDelimitedList"
  "S3Arns":
    "Default": "'arn:aws:s3:::'"
    "Description": "The S3 arns of cloudtrail event selectors"
    "Type": "CommaDelimitedList"
"Resources":
  "CloudTrail":
    "DependsOn":
    - "CloudTrailLogBucketPolicy"
    "Properties":
      "EnableLogFileValidation": "true"
      "EventSelectors":
      "DataResources": {"Fn::If" : ["S3Enabled", { "Type": "AWS::S3::Object", "Values": !Ref "S3Arns"}, {"Type": "AWS::Lambda::Function", "Values": !Ref "LambdaArns"}]}
      "IncludeGlobalServiceEvents": "true"
      "IsLogging": "true"
      "IsMultiRegionTrail": "true"
      "S3BucketName":
        "Ref": "CloudTrailLogBucket"
      "S3KeyPrefix": "sample"
      "TrailName": "sample"
    "Type": "AWS::CloudTrail::Trail"

我正在使用的资源

CloudTrail CloudFormation： https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html
Fn::If 文档： https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-if

我遇到过类似的问题，它们都导致缩进，但找不到我的模板的错误。

【问题讨论】：

标签： amazon-web-services amazon-cloudformation amazon-cloudtrail

【解决方案1】：

CloudFormation Linter 抓住了这一点：

E0000: Null value at line 31 column 24

DataResources 缩进不够远，EventSelectors 和 DataResources 都需要列表

All members of a list are lines beginning at the same indentation level starting with a "- " (a dash and a space)

我建议先让模板 sn-p 在没有 Fn::If 的情况下工作，如下所示：

"Resources":
  "CloudTrail":
    "DependsOn":
    - "CloudTrailLogBucketPolicy"
    "Properties":
      "EnableLogFileValidation": "true"
      "EventSelectors":
        - "DataResources":
           - Type: AWS::S3::Object
             Values: !Ref S3Arns

然后使用Fn::If设置DataResources列表中的第一个DataResource

【讨论】：

【解决方案2】：

yaml 可能是这样的：

cloudtrail:
    Type: AWS::CloudTrail::Trail
    Properties:       
      EnableLogFileValidation: Yes
      EventSelectors: 
        - DataResources:
            - Type: AWS::S3::Object
              Values: 
                - arn:aws:s3:::s3-event-step-bucket/    
          IncludeManagementEvents: Yes
          ReadWriteType: All
      IncludeGlobalServiceEvents: Yes
      IsLogging: Yes
      IsMultiRegionTrail: Yes
      S3BucketName: s3-event-step-bucket-storage       
      TrailName: xyz

【讨论】：