aws-cloudformation - 如何使用 yq 设置带有函数简写(即 !Sub)的 cloudformation 字段？

Question

我需要将托管策略添加到许多 cloudformation yaml 文件中的大量 lambda 和 ecs 任务角色。其中一些已经具有此数组字段，其中包含项目，而另一些则没有。我需要将一个项目添加到 ManagedPolicyArns 数组字段，其中该项目包含 cloudformation 简写形式，例如 !Sub。我正在使用 yq，这是一个很棒的工具，但我无法弄清楚如何使用文档来处理这个速记。

cloudformation.yaml:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  MyPrefix:
    Description: MyPrefix
    Type: String
Resources:
  MyRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
      Path: /

预期输出.yaml:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  MyPrefix:
    Description: MyPrefix
    Type: String
Resources:
  MyRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
        - Fn::ImportValue: !Sub "${MyPrefix}-my-new-policy-arn"
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
      Path: /

我失败的尝试:

add_policy.yq:

( .Resources[] |= 
    select(.Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "ecs-tasks.amazonaws.com" or .Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "lambda.amazonaws.com")
    .Properties.ManagedPolicyArns += {"Fn::ImportValue": {"!Sub": "${MyPrefix}-my-new-policy-arn"} }
)

命令:

yq --from-file add_policy.yq cloudformation.yaml 

输出:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  MyPrefix:
    Description: MyPrefix
    Type: String
Resources:
  MyRole:
    Type: AWS::IAM::Role
    Properties:
      ManagedPolicyArns:
        - Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
        - Fn::ImportValue:
            '!Sub': ${MyPrefix}-my-new-policy-arn
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ecs-tasks.amazonaws.com
                - lambda.amazonaws.com
            Action:
              - sts:AssumeRole
              - sts:TagSession
      Path: /

如何获得

        - Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
        - Fn::ImportValue: !Sub "${MyPrefix}-my-new-policy-arn"

而不是

        - Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
        - Fn::ImportValue:
            '!Sub': ${MyPrefix}-my-new-policy-arn

？

Answer 1

使用标签运算符

add_policy.yq:

( .Resources[] |= 
    select(.Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "ecs-tasks.amazonaws.com" or .Properties.AssumeRolePolicyDocument.Statement[].Principal.Service.[] == "lambda.amazonaws.com")
    .Properties.ManagedPolicyArns += {"Fn::ImportValue": "${AuthAuditBucketStackName}-logging-policy-arn" | . tag = "!Sub" }
)

结果:

- Fn::ImportValue: !Sub "${MyPrefix}-my-policy-arn"
- Fn::ImportValue: !Sub ${MyPrefix}-my-new-policy-arn

现在我不确定为什么字符串值没有被引用。