json - CloudFormation - 如何使用 Sub 内在函数？

Question

在下面的 JSON 规则中:

       {
         "Action": [
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
          "Resource": [
                "arn:aws:iam::${Account:Id}:policy/policy1",
                "arn:aws:iam::${Account:Id}:policy/policy2"
            ],
            "Effect": "Deny"
        }

---

如何使用Sub Resource 部分中的内部函数语法？替换变量...

编辑:

{
         "Action": [
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
          "Resource": [
                "arn:aws:iam::${Account:Id}:policy/policy1"
            ],
            "Effect": "Deny"
        }

如何引用单个资源？

Answer 1

 {
         "Action": [
                "iam:CreatePolicyVersion",
                "iam:DeletePolicy",
                "iam:DeletePolicyVersion",
                "iam:SetDefaultPolicyVersion"
            ],
          "Resource": [
                {  "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:policy/policy1"},
                {  "Fn::Sub": "arn:aws:iam::${AWS::AccountId}:policy/policy2"}
            ],
            "Effect": "Deny"
        }

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-sub.html