amazon-web-services - 云信息 : Create array of log ARNs from comma delimited list of log names

Question

我有参数LogNames - 以逗号分隔的日志名称列表:

  LogNames:
    Type: String
    Default: >-
      /aws/my-custom-log-1,/aws/my-custom-log-1

我想在 IAM 策略定义 - 资源 字段中使用它:

Resource:
  <array of allowed log ARNs created from LogNames parameter>

知道如何使用函数，例如Split、Join、Sub...生成正确的日志 ARN 数组？单个日志 ARN 的语法为:

- !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${LogName}:*'

Answer 1

没有 macro 就不可能或 custom resource 。没有这些的唯一方法是对您的 region 和 accountid 进行硬编码，并使用 Split、Join、Sub 的组合:

Parameters:
  LogNames:
    Type: CommaDelimitedList
    Default: >-
      /aws/my-custom-log-1,/aws/my-custom-log-2,/aws/my-custom-log-3

Resource:
          !Split:
            - ","
            - !Sub
                - "arn:aws:logs:us-east-1:234234234234:log-group:${logname}"
                - logname: !Join
                          - ",arn:aws:logs:us-east-1:234234234234:log-group:"
                          - !Ref LogNames