aws-cloudformation - 如何在 CloudFormation 中获取 AWS ServiceLinkedRole ARN

Question

我正在尝试使用 ServiceLinkedRole for Config 为 AWS Config 服务创建 CloudFormation 堆栈，但是我不知道如何在同一 CloudFormation 模板中引用创建的 AWS Config 角色的 ARN，这是配置片段:

  AWSServiceLinkedRoleForConfig:
    Type: 'AWS::IAM::ServiceLinkedRole'
    Properties:
      AWSServiceName: config.amazonaws.com
      Description: AWS Config Service Linked role
  ConfigRecorder: 
    Type: AWS::Config::ConfigurationRecorder
    Properties: 
      Name: AWSConfigForTest
      RecordingGroup: 
        ResourceTypes: 
          - "AWS::EC2::SecurityGroup"
      RoleARN: ??

我尝试过以下格式:

RoleARN: !Ref "AWSServiceLinkedRoleForConfig"

The role arn passed 'AWSServiceRoleForConfig' is not valid. (Service: AmazonConfig; Status Code: 400; Error Code: InvalidRoleException; )

RoleARN: !Ref "AWSServiceLinkedRoleForConfig.Arn"

Template format error: Unresolved resource dependencies [AWSServiceLinkedRoleForConfig.Arn] in the Resources block of the template

根据下面的备忘单，ServiceLinkedRole 资源没有输出 ARN: https://theburningmonk.com/cloudformation-ref-and-getatt-cheatsheet/

如果是这种情况，我如何在 CloudFormation 模板文件中引用此角色的 ARN？

Answer 1

我刚刚得到 AWS 的答复:

there is no way to directly reference the ARN of a service linked role created in CloudFormation

可用的解决方法:

角色ARN: !加入 - '' - - 'arn:aws:iam::' - !Ref 'AWS::AccountId' - ':role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig'