模板错误：每个 Fn::Sub 对象的上下文对象的每个值都必须是字符串或返回字符串的函数

Question

当我在 uat env 中运行此模板并作为字符串“vpc-1234”时，我希望将 aws:SourceVpc 添加为字符串列表 ["vpc-7830jkd", "vpc-a1236"] 当我在 perf 中运行时。它在 perf env 中运行良好，但是当我在 uat 中运行时出现以下错误。

模板错误：每个 Fn::Sub 对象的上下文对象的每个值都必须是字符串或返回字符串的函数。有什么建议吗？

这可以通过结合 select、join 和 findinmap 来实现吗？

 Mappings:
  mVpcId:
   menv:
    perf: "vpc-1234"
    uat: "vpc-7830jkd,vpc-a1236"
 
 islowenv: !Equals [ !Ref Env, "perf" ]
 
 Parameters:
   Env:
    Type: String
 
 Resources:
 apigateway:
   Type: "AWS::ApiGateway::RestApi"
     Properties:
    Name: mygateway
   EndpointConfiguration:
     Types:
       - "PRIVATE"
   Policy: !Sub
     - |-
       {
         "Version": "2012-10-17",
         "Statement": [
           {
             "Effect": "Allow",
             "Principal": "*",
             "Action": "execute-api:Invoke",
             "Resource": [
               "execute-api:/*"
             ]
           },
           {
             "Effect": "Deny",
             "Principal": "*",
             "Action": "execute-api:Invoke",
             "Resource": [
               "execute-api:/*"
             ],
             "Condition": {
               "StringNotEquals": {
                 "aws:SourceVpc": "${myappid}"    --> i need this as list when run in uat
               }
             }
           }
         ]
       }
    - { myappid: !If [islowenv, !FindInMap [ "mVpcId", "menv",  !Ref "Env" ], !Split [ ",", !FindInMap [ "mVpcId", "menv",  !Ref "Env"] ]]}

Answer 1

由于您现在有条件并且您的 vpc 列表是硬编码的，您可以使用 Select 和 Sub 的以下组合来生成有效的策略：

Mappings:
  mVpcId:
   menv:
    perf: "vpc-1234"
    uat: "vpc-7830jkd,vpc-a1236"

Conditions:
 islowenv: !Equals [ !Ref Env, "perf" ]

Parameters:
   Env:
    Type: String
    AllowedValues: [perf,uat]

Resources:

 apigateway:
   Type: "AWS::ApiGateway::RestApi"
   Properties:
    Name: mygateway
    EndpointConfiguration:
      Types:
        - "PRIVATE"
    Policy: !Sub
        - |-
          {
            "Version": "2012-10-17",
            "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": "execute-api:Invoke",
                "Resource": [
                "execute-api:/*"
                ]
            },
            {
                "Effect": "Deny",
                "Principal": "*",
                "Action": "execute-api:Invoke",
                "Resource": [
                "execute-api:/*"
                ],
                "Condition": {
                "StringNotEquals": {
                    "aws:SourceVpc": ${myappid}
                }
               }
            }
            ]
          }
        - myappid:
           !If
             - islowenv
             - !Sub
               - "\"${value}\""
               - value: !FindInMap ["mVpcId", "menv",  !Ref "Env" ]
             - !Sub
               - "[\"${value1}\", \"${value2}\"]"
               - value1: !Select [0, !Split [ ",", !FindInMap [ "mVpcId", "menv",  !Ref "Env"] ]]
                 value2: !Select [1, !Split [ ",", !FindInMap [ "mVpcId", "menv",  !Ref "Env"] ]]

但如果您需要它来处理任何长度的任何 vpc 列表，那么您需要自定义资源或宏。