amazon-web-services - Cloudformation 模板中 IAM 资源之间的循环依赖关系

Question

我在我的 cloudformation 模板中不断遇到循环依赖错误，并且不知道如何消除它。我正在创建一个用户并将 IAMManagedPolicy2 附加到该用户。该策略允许用户承担两个角色:IAMRole 和 IAMRole2。IAMRole2 需要定义用户的假设权限。这可能就是我在我的例子中遇到循环依赖的原因。我的模板如下所示:

AWSTemplateFormatVersion: "2010-09-09"
Metadata:
    Generator: "former2"
Description: ""
Resources:
    IAMUser:
        Type: "AWS::IAM::User"
        Properties:
            Path: "/"
            UserName: "sysuser"
            ManagedPolicyArns: 
              - !Ref IAMManagedPolicy2

    IAMGroup:
        Type: "AWS::IAM::Group"
        Properties:
            Path: "/"
            GroupName: "Temp"


    IAMManagedPolicy2:
        Type: "AWS::IAM::ManagedPolicy"
        Properties:
            ManagedPolicyName: "UserAssumePolicy"
            Path: "/"
            PolicyDocument: !Sub |
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "VisualEditor0",
                            "Effect": "Allow",
                            "Action": "sts:AssumeRole",
                            "Resource": [
                                "arn:aws:iam::*:role/${IAMRole}",
                                "arn:aws:iam::*:role/${IAMRole2}"
                            ]
                        }
                    ]
                }


    IAMRole:
        Type: "AWS::IAM::Role"
        Properties:
            Path: "/"
            RoleName: "AddUserToGroupRole"
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    -
                        Effect: "Allow"
                        Principal:
                          AWS:
                            - !GetAtt IAMUser.Arn
                        Action:
                          - "sts:AssumeRole"
            MaxSessionDuration: 3600
            ManagedPolicyArns: 
              - !Ref IAMManagedPolicy3
            Description: "Allows Adding users to group"


    IAMRole2:
        Type: "AWS::IAM::Role"
        Properties:
            Path: "/"
            RoleName: "AttachGroupPolicyRole"
            AssumeRolePolicyDocument:
                Version: "2012-10-17"
                Statement:
                    -
                        Effect: "Allow"
                        Principal:
                          AWS:
                            - !GetAtt IAMUser.Arn
                          Service:
                            - "ec2.amazonaws.com"
                        Action:
                          - "sts:AssumeRole"
            MaxSessionDuration: 3600
            ManagedPolicyArns: 
              - !Ref IAMManagedPolicy
            Description: ""
            Tags: 
              - 
                Key: "event"
                Value: "troopers"

    IAMManagedPolicy:
        Type: "AWS::IAM::ManagedPolicy"
        Properties:
            ManagedPolicyName: "AttachGroupPolicy"
            Path: "/"
            PolicyDocument: !Sub |
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "VisualEditor0",
                            "Effect": "Allow",
                            "Action": "iam:AttachGroupPolicy",
                            "Resource": [
                                "arn:aws:iam::*:group/${IAMGroup}"
                            ]
                        }
                    ]
                }

    IAMManagedPolicy3:
        Type: "AWS::IAM::ManagedPolicy"
        Properties:
            ManagedPolicyName: "AddUserToGroup"
            Path: "/"
            PolicyDocument: !Sub |
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "VisualEditor0",
                            "Effect": "Allow",
                            "Action": "iam:AddUserToGroup",
                            "Resource": [
                                "arn:aws:iam::*:group/${IAMGroup}"
                            ]
                        }
                    ]
                }

有人可以帮我指出消除循环依赖并使模板正常工作的更改吗，

Answer 1

由于您对角色名称(AddUserToGroupRole 和 AttachGroupPolicyRole)进行硬编码，因此您必须直接使用名称来克服循环依赖问题:

    IAMManagedPolicy2:
        Type: "AWS::IAM::ManagedPolicy"
        Properties:
            ManagedPolicyName: "UserAssumePolicy"
            Path: "/"
            PolicyDocument: !Sub |
                {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Sid": "VisualEditor0",
                            "Effect": "Allow",
                            "Action": "sts:AssumeRole",
                            "Resource": [
                                "arn:aws:iam::*:role/AddUserToGroupRole",
                                "arn:aws:iam::*:role/AttachGroupPolicyRole"
                            ]
                        }
                    ]
                }