amazon-web-services - 如何处理 aws cloudformation 模板中的多个重复键 (Fn::Sub)？

Question

我有一个正在 cloudformation 模板中制定的策略。我想向策略添加两个资源，它们最终是 arn::bucket 和 arn::bucket/* 。问题是 arn 是一个参数，我收到错误:[cfn-lint] E0000:找到重复资源“Fn::Sub”(第 161 行)。我知道它不喜欢重复的内容。

"RolePolicies": {
          "Type": "AWS::IAM::Policy",
          "Properties": {
              "PolicyName": "GetGEBucketPutCustomerBucket",
              "PolicyDocument": {
                  "Statement": [
                      {
                          "Action": [
                            "s3:PutObject",
                            "s3:GetObject",
                            "s3:GetObjectAttributes",
                            "s3:GetObjectTagging",
                            "s3:ListBucket",
                            "s3:DeleteObject"
                          ],
                          "Effect": "Allow",
                          "Resource": {
                              "Fn::Sub": [
                                  "${arn}/*",
                                  {
                                      "arn": {
                                          "Ref": "CustomerS3BucketARN"
                                      }
                                  }
                              ],
                              "Fn::Sub": [
                                "${arn}",
                                {
                                    "arn": {
                                        "Ref": "CustomerS3BucketARN"
                                    }
                                }
                            ]
                          }
                      }
                  ]
              },
              "Roles": [
                  {
                      "Ref": "InstanceRole"
                  }
              ]
          },
          "Metadata": {
              "AWS::CloudFormation::Designer": {
                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"
              }
          }
      }

但是，允许此 cloudformation 运行，但会产生错误。创建后在 IAM 控制台窗口中查看策略时，我发现这两个资源均未创建。

IAM 策略编辑器给我这个错误。Ln 1, Col 0Missing Version:我们建议您指定 Version 元素以帮助您调试权限问题。 因为以 /* 结尾的资源不是由云的形成。

Answer 1

我发现解决这个问题的最简单方法是将操作分成多个部分。这使我能够使用 Fn::Sub 函数并将事物分开。唯一的缺点是我必须创建 4 项政策声明，而不是 2 项。

"RolePolicies": {
          "Type": "AWS::IAM::Policy",
          "Properties": {
              "PolicyName": "GetGEBucketPutCustomerBucket",
              "PolicyDocument": {
                  "Statement": [
                      {
                          "Action": [
                            "s3:ListBucket"
                          ],
                          "Effect": "Allow",
                          "Resource": {
                              "Fn::Sub": [
                                  "${arn}",
                                  {
                                      "arn": {
                                          "Ref": "GeS3BucketARN"
                                      }
                                  }
                              ]
                          }
                      },
                      {
                        "Action": [
                          "s3:GetObject",
                          "s3:GetObjectAttributes",
                          "s3:GetObjectTagging"
                        ],
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::Sub": [
                                "${arn}/*",
                                {
                                    "arn": {
                                        "Ref": "GeS3BucketARN"
                                    }
                                }
                            ]
                        }
                    },
                    {
                        "Action": [
                          "s3:ListBucket"
                        ],
                        "Effect": "Allow",
                        "Resource": {
                            "Fn::Sub": [
                                "${arn}",
                                {
                                    "arn": {
                                        "Ref": "CustomerS3BucketARN"
                                    }
                                }
                            ]
                        }
                    },
                      {
                          "Action": [
                            "s3:PutObject",
                            "s3:GetObject",
                            "s3:GetObjectAttributes",
                            "s3:GetObjectTagging",
                            "s3:DeleteObject"
                          ],
                          "Effect": "Allow",
                          "Resource": {
                              "Fn::Sub": [
                                  "${arn}/*",
                                  {
                                      "arn": {
                                          "Ref": "CustomerS3BucketARN"
                                      }
                                  }
                              ]
                          }
                      }                      
                  ]
              },
              "Roles": [
                  {
                      "Ref": "InstanceRole"
                  }
              ]
          },
          "Metadata": {
              "AWS::CloudFormation::Designer": {
                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"
              }
          }
      }