json - 需要将 IAMPass Role 应用到特定环境

Question

我有cloudformation模板。这里我们有多个环境(dev、qa、uat)并且需要对所有环境使用相同的模板。在模板中"Action": ["iam:PassRole"]下有4个资源，其中3个资源属于qa。当我在 dev 和 uat 环境上部署代码时，qa 资源也适用于 dev 和 uat 环境，但我只需要为 qa 环境创建这 3 个 qa 资源。我尝试了一些条件但不起作用。有没有什么方法可以解决这个问题。请找到下面的模板代码。

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Resources": {
    "CloudFormationRole": {
      "Type": "AWS::IAM::Role",
      "Description": "Service role in IAM for AWS CloudFormation",
      "Properties": {
        "RoleName": {
          "Fn::Sub": "${Environment}-workflow-CloudFormationRole"
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "WorkerCloudFormationRolePolicy",
            "PolicyDocument": {
              "Statement": [
                {
                  "Action": [
                    "lambda:AddPermission",
                    "lambda:PutFunctionEventInvokeConfig",
                    "lambda:UpdateFunctionEventInvokeConfig"
                  ],
                  "Resource": {
                    "Fn::Sub": "arn:aws:lambda:function:orderser-${Environment}-workflow-*"
                  },
                  "Effect": "Allow"
                },
                {
                  "Action": [
                    "iam:PassRole"
                  ],
                  "Resource": [
                    {"Fn::Sub": "arn:aws:iam::role/orderser-workflow-*"},
                    {"Fn::Sub": "arn:aws:iam::role/orderserv-qa-workflowLambdaRole1"},
                    {"Fn::Sub": "arn:aws:iam::role/orderserv-qa-workflowLambdaRole2"},
                    {"Fn::Sub": "arn:aws:iam::role/orderserv-qa-workflowLmbdRole3"}
                  ],
                  "Effect": "Allow"
                }
              ]
            }
          }
        ]
      }
    }
  }
}

Answer 1

参数化传递角色 ARN，并为每个环境设置不同的参数文件

并且，由于您有多个值，请使用 CommaDelimitedList 类型参数，该参数可以采用多个字符串值

引用此处:https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html