如何根据条件在 S3 上启用/禁用加密答案

【问题标题】：How to enable/disable encryption on S3 based on condition如何根据条件在 S3 上启用/禁用加密
【发布时间】：2023-03-25 04:30:01
【问题描述】：

如何根据条件禁用或启用 S3 存储桶上的加密 (AES256)？

  TestBucket:
    Type: AWS::S3::Bucket
    DependsOn: TestSnsTopicPolicy
    Properties:
      BucketName: !Ref TestBucket

      BucketEncryption:
        !If
        - **conditionForEnableOrDisableEncryption**
        - 
          ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
        - !Ref "AWS::NoValue"
      Tags:
        - Key: "EnvironmentName"
          Value: !Ref EnvironmentName
        - Key: "ProjectName"
          Value: !Ref ProjectName
      ForceEncryption:
        !If
        - **conditionForEnableOrDisableEncryption**
        -   
          Type: AWS::S3::BucketPolicy
          Properties:
            Bucket: !Ref TestBucket
            PolicyDocument:
              Version: "2008-10-17"
              Statement:
                - Sid: DenyUnEncryptedObjectUploads
                  Effect: Deny
                  Principal: "*"
                  Action:
                    - s3:PutObject
                  Resource:
                    - !Join ["", ["arn:aws:s3:::", !Ref TestBucket, "/*"]]
                  Condition:
                    StringNotEquals:
                      "s3:x-amz-server-side-encryption":
                        - "AES256"
          DependsOn: TestBucket
        - !Ref "AWS::NoValue"

请参考上面的代码 sn-p .Iam 得到错误为“无效的模板资源属性'Fn::If'”

【问题讨论】：

标签： amazon-web-services amazon-s3 amazon-cloudformation

【解决方案1】：

您可以在模板中创建conditions 部分。例如：

Parameters:

  EnableEncryption:
    Type: String
    Default: false
    AllowedValues: [true, false]


Conditions:

  ShouldEnableEncryption:
    !Equals [!Ref EnableEncryption, true]


Resources:

  TestBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref TestBucketName
      BucketEncryption:
        !If
        - ShouldEnableEncryption
        - 
          ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
        - !Ref "AWS::NoValue"
      Tags:
        - Key: "EnvironmentName"
          Value: !Ref EnvironmentName
        - Key: "ProjectName"
          Value: !Ref ProjectName

  ForceEncryption:
      Type: AWS::S3::BucketPolicy
      Condition: ShouldEnableEncryption
      Properties:
        Bucket: !Ref TestBucket
        PolicyDocument:
          Version: "2008-10-17"
          Statement:
            - Sid: DenyUnEncryptedObjectUploads
              Effect: Deny
              Principal: "*"
              Action:
                - s3:PutObject
              Resource:
                - !Join ["", ["arn:aws:s3:::", !Ref TestBucket, "/*"]]
              Condition:
                StringNotEquals:
                  "s3:x-amz-server-side-encryption":
                    - "AES256"

【讨论】：