amazon-web-services - 有没有办法访问AWS CloudFormation中的 "clone"资源

Question

我想在 CloudFormation 堆栈中创建 3 个角色:BaseRole、Role1 和 Role2。 Role1基于BaseRole但添加了一个策略，Role2是在Role2的基础上添加了另一个策略。

我目前正在每个角色中定义“BaseRole”，它看起来很愚蠢...只是想知道是否有更好的方法来定义它们，以便 Role1 可以引用 BaseRole 中定义的内容并只需添加额外的策略， Role2 引用 Role1 然后添加另一个策略？

以下是我目前定义这些角色的方式:

  BaseRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
  Role1:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/CloudWatchLogsFullAccess"

  Role2:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      ManagedPolicyArns:
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/CloudWatchLogsFullAccess"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"

Answer 1

唯一的方法是通过nested stacks :

As your infrastructure grows, common patterns can emerge in which you declare the same components in multiple templates. You can separate out these common components and create dedicated templates for them. Then use the resource in your template to reference other templates, creating nested stacks.