amazon-web-services - AWS 云信息 : How to loop over CommaDelimitedList to create IPSetReferenceStatements in WebACL Rules?

Question

我正在尝试创建一个 WebACL，在其中我可以提供外部提供程序列表作为 CommaDelimitedList，并循环这些值以基于每个提供程序创建具有多个 IPSetReferenceStatement 的 OrStatement。我为每个已创建的提供商都有一个 IPSet，但需要在报表中动态使用它们。我该怎么做呢？我想要实现这样的目标。

---
AWSTemplateFormatVersion: "2010-09-09"
Description: "WAF Configuration"

Parameters:
  Country:
    Type: String
  ExternalProvidersWhitelist:
    Type: CommaDelimitedList
    Description: List of external providers to be whitelisted
  DefaultBehaviour:
    Type: String
    AllowedValues: [ allow, block ]

Conditions:
  DefaultBehaviourAllow: !Equals [ !Ref DefaultBehaviour, allow ]

Resources:
  WebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub '${Country}-WebACL-common'
      DefaultAction:
        Fn::If: [ DefaultBehaviourAllow, Allow: { }, Block: { } ]
      Scope: CLOUDFRONT
      VisibilityConfig:
        MetricName: !Sub '${Country}-WebACL-common'
        CloudWatchMetricsEnabled: true
        SampledRequestsEnabled: true
      Rules:
        - Name: !Sub '${Country}-WebACL-IPWhitelist'
          Action:
            Allow: { }
          Priority: 1
          VisibilityConfig:
            MetricName: !Sub '${Country}-WebACL-IPWhitelist-metric'
            CloudWatchMetricsEnabled: true
            SampledRequestsEnabled: true
          Statement:
            OrStatement:
              Statements:
              #TODO: Something like 
              #foreach provider in ExternalProvidersWhitelist:
              #  - IPSetReferenceStatement:
              #      Arn:
              #        Fn::ImportValue: !Sub '${Country}-${Provider}-Arn'

我尝试使用以下内容检查 CommaDelimitedList 中是否存在提供程序

Conditions:
  IsProviderAWhitelisted:
    Fn::Contains:
     - !Split [ ",", !Ref ExternalProvidersWhitelist ]
     - "ProviderA"

...然后在语句的 !If block 中使用此条件

          Statement:
            OrStatement:
              Statements:
                - IPSetReferenceStatement:
                    Arn:
                      Fn::ImportValue: !Sub '${Country}-BaseWhitelist-Arn'
                - !If
                  - IsProviderAWhitelisted
                  - IPSetReferenceStatement:
                      Arn:
                        Fn::ImportValue: !Sub '${Country}-ProviderA-Arn'
                  - !Ref AWS::NoValue

它不仅不起作用，因为我们无法在 Conditions 中使用 Fn::Contains，而且对于每个提供程序来说，重复次数太多。

Answer 1

您必须创建自己的 CloudFormation macro ，因为 CloudFormation 不支持迭代。