amazon-web-services - 如何在cloudformation中引用AWS托管策略arn？

Question

我将使用 cloudformation 创建一个 IAM 用户，并且需要附加 AWS 托管策略 AWSAppSyncInvokeFullAccess。我想我应该使用像下面的代码这样的托管策略:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Ref AWSAppSyncInvokeFullAccess
        - !Ref AWSLambdaBasicExecutionRole

但它不起作用，因为 AWSAppSyncInvokeFullAccess 来自 AWS 而不是来自此模板。引用政策的正确方法是什么？

Answer 1

这些是现有的 AWS 托管策略。因此，您应该使用他们的完整 ARN，您可以从 IAM 控制台获取该信息:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

更新

或者使其独立于分区:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSAppSyncInvokeFullAccess"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"