amazon-web-services - 模板包含错误。 : [/Resources/CloudTrail/Type/EventSelectors] 'null' values are not allowed in templates in AWS CloudFormation CloudTrail

Question

当我尝试验证我的 cloudformation 模板时，收到“模板包含错误。:[/Resources/CloudTrail/Type/EventSelectors] 模板中不允许使用“null”值”错误。

"Conditions":
  "S3Enabled":
    "Fn::Equals":
    - "IsS3Enabled"
    - "true"
"Parameters":
  "IsS3Enabled":
    "AllowedValues":
    - "true"
    - "false"
    "Default": "true"
    "Description": "whether you want cloudtrail enabled for S3"
    "Type": "String"
  "LambdaArns":
    "Default": "arn:aws:lambda"
    "Description": "The lambda arns of cloudtrail event selectors"
    "Type": "CommaDelimitedList"
  "S3Arns":
    "Default": "'arn:aws:s3:::'"
    "Description": "The S3 arns of cloudtrail event selectors"
    "Type": "CommaDelimitedList"
"Resources":
  "CloudTrail":
    "DependsOn":
    - "CloudTrailLogBucketPolicy"
    "Properties":
      "EnableLogFileValidation": "true"
      "EventSelectors":
      "DataResources": {"Fn::If" : ["S3Enabled", { "Type": "AWS::S3::Object", "Values": !Ref "S3Arns"}, {"Type": "AWS::Lambda::Function", "Values": !Ref "LambdaArns"}]}
      "IncludeGlobalServiceEvents": "true"
      "IsLogging": "true"
      "IsMultiRegionTrail": "true"
      "S3BucketName":
        "Ref": "CloudTrailLogBucket"
      "S3KeyPrefix": "sample"
      "TrailName": "sample"
    "Type": "AWS::CloudTrail::Trail"

我正在使用的资源

1. CloudTrail 云形成: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudtrail-trail.html
2. Fn::如果文档: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-if

我遇到过类似的问题，它们都会导致缩进，但找不到我的模板的错误。

1. AWS Cloudformation [/Resources/PrivateGateway/Properties] 'null' values are not allowed in templates
2. AWS IAM Cloudformation YAML template errror: 'null' values are not allowed

Answer 1

CloudFormation Linter捕捉到这个:

E0000:第 31 行第 24 列为空值

---

DataResources 缩进不够远，EventSelectors 和 DataResources 都需要是列表

All members of a list are lines beginning at the same indentation level starting with a "- " (a dash and a space)

---

我建议让模板片段在没有 Fn::If 的情况下工作首先是这样的:

"Resources":
  "CloudTrail":
    "DependsOn":
    - "CloudTrailLogBucketPolicy"
    "Properties":
      "EnableLogFileValidation": "true"
      "EventSelectors":
        - "DataResources":
           - Type: AWS::S3::Object
             Values: !Ref S3Arns

然后使用Fn::If设置第一个DataResource在DataResources列表中