amazon-web-services - 云信息 : How to add an existing IAM managed policy to an Existing IAM ROLE

Question

我知道以下场景

向现有 IAM 角色添加新的 IAM 托管策略

Parameters:
  awsExampleRolesParameter:
    Type: CommaDelimitedList
    Description: Names of existing Roles you want to add to the newly created Managed Policy

Resources:
  SampleManagedPolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: AllowAllUsersToListAccounts
            Effect: Allow
            Action:
              - 'iam:ListAccountAliases'
              - 'iam:ListUsers'
              - 'iam:GetAccountSummary'
            Resource: '*'
      Roles: !Ref awsExampleRolesParameter

将现有 IAM 托管策略添加到新的 IAM 角色

Parameters:
  awsExampleManagedPolicyParameterOne:
    Type: String
    Description: 'ARN of the first IAM Managed Policy to add to the role'
  awsExampleManagedPolicyParameterTwo:
    Type: String
    Description: 'ARN of the second IAM Managed Policy to add to the role'

Resources:
  RootRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      ManagedPolicyArns:
        - !Ref awsExampleManagedPolicyParameterOne
        - !Ref awsExampleManagedPolicyParameterTwo

现在我正在寻找一个场景

如何将现有托管策略附加到现有角色

Parameters:
  awsExampleRolesParameter:
    Type: CommaDelimitedList
    Description: Names of existing Roles you want to add to the newly created Managed Policy
  awsExampleManagedPolicyParameterOne:
    Type: String
    Description: 'ARN of the first IAM Managed Policy to add to the role'
  awsExampleManagedPolicyParameterTwo:
    Type: String
    Description: 'ARN of the second IAM Managed Policy to add to the role'

......   WHAT TO DO HERE TO ATTACHE 
........ THE MANAGED POLICIES awsExampleManagedPolicyParameterOne and awsExampleManagedPolicyParameterTwo
........ TO THE ROLE awsExampleRolesParameter

Answer 1

如果没有custom resource，您就无法做到这一点。为此，您必须开发一个 lambda 函数，它将角色的 ARN 和策略作为输入，并使用 AWS SDK(例如 boto3)来修改角色。