amazon-web-services - 如何将用户定义的条件添加到 AWS Cloudformation 中的策略文档声明中

Question

在 AWS Cloudformation 中，我有一个用户定义的条件，并且正在部署一个存储桶策略:

Conditions:
  NotProd:
    !Not [!Equals [!Ref Environment, production]]

...
BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: NotProd
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:getObject
            Effect: Allow
            Principal:
              AWS: '*'
            Resource: '*'
          - Action:
              - s3:getBucketLocation
            Effect: Allow
            Principal:
              AWS: '*'
            Resource: '*'

上面的配置没有问题，但是当我尝试添加条件时，仅当我们不在生产中时才添加 s3:getBucketLocation 权限，如下所示:

BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:getObject
            Effect: Allow
            Principal:
              AWS: '*'
            Resource: '*'
          - Action:
              - s3:getBucketLocation
            Effect: Allow
            Principal:
              AWS: '*'
            Resource: '*'
            Condition: NotProd

，然后我收到一条错误消息，指出Condition NotProd notused。有什么方法可以实现我想要的结果，即仅在不在生产中时添加 s3:getBucketLocation ，而不执行诸如在没有 s3:getBucketLocation 权限的情况下创建单独的存储桶策略之类的操作？

Answer 1

您必须使用If :

BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          - Action:
              - s3:getObject
            Effect: Allow
            Principal:
              AWS: '*'
            Resource: '*'
          - !If
            - NotProd
            - Action:
                - s3:getBucketLocation
              Effect: Allow
              Principal:
                AWS: '*'
              Resource: '*'
            - !Ref "AWS::NoValue"