Cloudformation 模板错误：每个 Fn::GetAtt 对象都需要两个非空参数

Question

我制作了一个嵌套的 cloudformation 堆栈，在这种情况下它引用了一个 Lambda 子堆栈。 因为我有多个 LambdaFunction，所以我在 Lambda 子中设计了 LambdaFunction 资源 模板，以便它可以在父模板中指定的所有 Lambda 函数中重复相同的操作。

但是，一旦我执行create-stack：Template error: every Fn::GetAtt object requires two non-empty parameters, the resource name and the resource attribute，我就会收到以下错误，它指向 Lambda Child 模板。

我尝试添加一个 我在其中列出了所有 LambdaExecutionRoles 的 DependsOn 子句，因为 LambdaFunction 引用了这些，但是 似乎没有解决问题。因此，接受 LambdaName 参数可能会出现问题 或抓住 Arn。有什么想法吗？

父模板部分：

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  AlignmentLambdaFuncS3BucketName:
    Type: String
  AlignmentLambdaFuncS3KeyName:
    Type: String
  AlignmentLambdaFuncModuleName:
    Type: String
  HaploLambdaFuncS3BucketName:
    Type: String
  HaploLambdaFuncS3KeyName:
    Type: String
  HaploLambdaFuncModuleName:
    Type: String

Resources:
  AlignmentLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        LambdaName: Alignment
        BucketName: LambdaFuncS3BucketName
        S3KeyName: LambdaFuncS3KeyName
        ModuleName: LambdaFuncModuleName
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  HaploLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        LambdaName: Haplo
        BucketName: LambdaFuncS3BucketName
        S3KeyName: LambdaFuncS3KeyName
        ModuleName: LambdaFuncModuleName
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

Lambda 子模板部分：

AWSTemplateFormatVersion: '2010-09-09'
Description: lambda function and execution role stack.
Parameters:
  LambdaName:
    Type: String
  BucketName:
    Type: String
  S3KeyName:
    Type: String
  ModuleName:
    Type: String
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String

Resources:
  LambdaFunction: 
    Type: "AWS::Lambda::Function"
    Properties:
      Handler: !Sub '${LambdaName}-{ModuleName}.handler'
      Role:
        Fn::GetAtt: [ !Sub '${LambdaName}LambdaExecutionRole', Arn ]
      Code:
        S3Bucket: !Sub '${LambdaName}{BucketName}'
        S3Key: !Sub '${LambdaName}{S3KeyName}'
      Runtime: "python3.6"



  AlignmentLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  HaploLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

Answer 1

很遗憾，您不能在Fn::GetAtt 的逻辑资源名称中使用任何函数（例如Sub）：

对于 Fn::GetAtt 逻辑资源名称，您不能使用函数。您必须指定一个作为资源逻辑 ID 的字符串。

来源：https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html