amazon-web-services - 如何使用 cloudformation 生成 AWS 字符串条件

Question

我有以下代码，但无法使用 StringEquals 获取结束部分来打印运行 cloudformation 的正确值。

Parameters:
  OpenIDClientIdList:
    Type: String
    Description: Open ID client ID 
    Default: urn:dev.aws.services.xxxxx.com

  OpenIDURL:
    Type: String
    Description: Open ID URL
    Default: "sts.windows.net/dddddd-rr444-ssss-94c3-7484898492d/"

Resources:
  OpenIDCAssumeReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: OpenIDCAssumeReadOnlyRole
      ManagedPolicyArns: [arn:aws:iam::aws:policy/ReadOnlyAccess]
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/${OpenIDURL}
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals: !Sub
              - ''
              - - '${OpenIDURL}:aud:'
                - '${OpenIDClientIdList}'

预期条件字符串值

         "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "sts.windows.net/dddddd-rr444-ssss-94c3-7484898492d/:aud": "urn:dev.aws.services.xxxxx.com"
                }
            }

Answer 1

您没有正确使用!Sub。条件应如下所示:

Condition:
  StringEquals: 
    Fn::Base64: !Sub
    - |
      "${OPENIDURL}:aud": "${OPENIDCLIENTIDLIST}"
    - OPENIDURL: !Ref OpenIDURL
      OPENIDCLIENTIDLIST: !Ref OpenIDClientIdList