amazon-web-services - CommaDelimitedList、fn :if and fn:select 的 AWS Cloudformation 组合

Question

我正在尝试创建一个 cfn 堆栈。模板采用一个/两个值作为参数部分的输入。如果我从参数中传递两个值，则在资源部分中读取相同的值，则其工作正常。但如果我通过了一个，它就会崩溃。

用例:- 我想从参数传递两个值并在 iam 策略中读取它们。如果用户传递一个值，则应使用 {"Ref": "AWS::NoValue"}。但我一直在努力

模板错误:Fn::Select 无法选择索引 1 处不存在的值

这是模板 -

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "Template creates a IAMUser and attach a ListALLBuckets/ReadOnly Access Policy to it.",
    "Parameters": {
        "UserName": {
            "Type": "String",
            "Description": "Enter User Name"
        },
        "S3Bucket": {
            "Type": "CommaDelimitedList",
            "Description": "Select Bucket Name to Associate with the policy",
            "Default": ""
        }
    },
    "Conditions": {
        "CreateSomeResource": {
            "Fn::Not": [{
                "Fn::Equals": [{
                        "Fn::Join": [
                            "",
                            {
                                "Ref": "S3Bucket"
                            }
                        ]
                    },
                    ""
                ]
            }]
        }
    },
    "Resources": {
        "SomeUserName": {
            "Type": "AWS::IAM::User",
            "Properties": {
                "UserName":  {  "Ref": "UserName"}
            }
        },
        "SomeUserPolicy": {
            "Type": "AWS::IAM::Policy",
            "Properties": {
                "Groups": [],
                "PolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [{
                            "Sid": "ListAllBuckets",
                            "Effect": "Allow",
                            "Action": [
                                "s3:ListAllMyBuckets"
                            ],
                            "Resource": "*"
                        }, {
                            "Sid": "ReadOnlyAccess",
                            "Effect": "Allow",
                            "Action": [
                                "s3:GetBucketPolicyStatus",
                                "s3:GetBucketTagging",
                                "s3:GetBucketLocation",
                                "s3:GetBucketPolicy",
                                "s3:GetObject"
                            ],
                            "Resource": [

                                {
                                    "Fn::If": [
                                        "CreateSomeResource",
                                        {
                                            "Fn::Join": ["", ["arn:aws:s3:::",
                                                {
                                                    "Fn::Select": ["0",
                                                        {
                                                            "Ref": "S3Bucket"
                                                        }
                                                    ]
                                                }
                                            ]]
                                        },
                                        {"Ref" : "AWS::NoValue"}
                                    ]
                                },

                                {
                                    "Fn::If": [
                                        "CreateSomeResource",
                                        {
                                            "Fn::Join": ["", ["arn:aws:s3:::",
                                                {
                                                    "Fn::Select": ["1",
                                                        {
                                                            "Ref": "S3Bucket"
                                                        }
                                                    ]
                                                }
                                            ]]
                                        },
                                        {"Ref" : "AWS::NoValue"}
                                    ]
                                }
                            ]
                        }

                    ]
                },
                "PolicyName": "ReadOnly",

                "Users": [{
                    "Ref": "SomeUserName"
                }]
            }
        }
    },
    "Outputs": {
        "UserName": {
            "Description": "Name of the Created User",
            "Value": {
                "Ref": "UserName"
            }
        }
    }
}

Answer 1

如果S3Bucket只有一个值，则:

"Fn::Select": ["1",
    {
        "Ref": "S3Bucket"
    }

显然是无效的。遗憾的是，那里的 CreateSomeResource 条件并不重要。无论条件为 true 或 false，选择都必须有效。

最简单的解决方案可能是将存储桶作为两个单独的参数传递，即S3Bucket1和S3Bucket2，并且每个参数都有各自的条件.