amazon-web-services - AWS CFT 模板 IAM 策略

Question

我正在使用 CFT 创建一项 IAM 策略，该策略仅允许单独访问一个 S3 存储桶(该存储桶也是在同一 CFT 本身中创建的)。这是CFT的问题所在的部分

    {
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "BucketCreation":{
            "Type": "AWS::S3::Bucket",
            "Properties": {
               "BucketName":"samplebucket",
              }
            },
        "IAMPolicy":{
          "Type": "AWS::IAM::Policy",
          "Properties": {
            "PolicyName": "ListS3BucketsPolicy",
            "PolicyDocument": {
                "Statement": [{
                    "Effect": "Allow",
                    "Action": [
                        "s3:*"
                    ],
                    "Resource": "Fn::GetAtt" : [ "BucketCreation" , "Arn" ]
                }]
             }
          }
       } 
    } 
  }

现在，上面的 cft 使用资源语句创建 IAM 策略 "Resource": "arn:aws:s3:::bucketname" 这仅提供存储桶访问权限，而不提供对象级别访问权限。我需要的是看起来像这样的资源部分 "Resource": "arn:aws:s3:::bucketname/*"。这在 CFT 中可能吗？

Answer 1

是的，可以，请参阅 here

You can use wildcards as part of the resource ARN. You can use wildcard characters (* and ?) within any ARN segment (the parts separated by colons). An asterisk (*) represents any combination of zero or more characters, and a question mark (?) represents any single character. You can use multiple * or ? characters in each segment, but a wildcard cannot span segments.

This ARN uses the wildcard * in the relative-ID part of the ARN to identify all objects in the example bucket.

更新:要连接 /* 请查看 intrinsic functions像Join