aws-cloudformation - 用于更新 IAM 角色策略的 CloudFormation 模板

Question

是否可以创建一个 CloudFormation 模板，将 IAM 角色的 ARN 作为输入并更新分配给它的策略以添加更多权限？我尝试与 CloudFormation 设计器合作，但它非常困惑且不简单，

Answer 1

是的，您可以使用如下模板来执行此操作:

Description: Add policy to existing role

Parameters:

  MyExistingRoleName:
    Type: String
    Description: Name of the Role you want to add a policy to

Resources:

  MyNewPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "my-new-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Action:
            - "s3:ListAllMyBuckets"
          Resource:
            - "*"
      Roles:
        - !Ref MyExistingRoleName