amazon-s3 - CloudFormation BucketPolicy 停留在 CREATE。从未完成创建

Question

云使用用户、用户访问 key 和策略形成 S3 存储桶。它应该创建堆栈并输出通过 SDK 使用创建的 S3 存储桶所需的用户访问 key 。当尝试引用 BucketPolicy 主体中的 BucketUser ARN 时，存储桶策略会永远陷入 CREATING 阶段。

CloudFormation 成功

BucketPolicy:...主体:“*”

但是 BucketPolicy 资源永远卡在 CREATE 中

BucketPolicy:...主体:!GetAtt BucketUser.Arn

当BucketPolicy:...主体:“*”时，这会成功返回BucketUser.Arn

Outputs:
  BucketUserArn:
    Value: !GetAtt BucketUser.Arn

所需模板:

AWSTemplateFormatVersion: "2010-09-09"
Description: "Creates bucket with bucket policy"
#Metadata: 
Parameters:
  app:
    Type: String
    Description: (required) Application name (Also used for bucket name. Follow S3 bucket name conventions)
    Default: ymessage-bucket-test
Resources:
  BucketUser:
    Type: "AWS::IAM::User"
    Properties: 
      UserName: !Ref app
  UserAccessKey:
    Type: "AWS::IAM::AccessKey"
    Properties: 
      Status: Active
      UserName: !Ref app
    DependsOn: BucketUser
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref app
  BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties: 
        Bucket: !Ref app
        PolicyDocument: 
          Statement: 
            - 
              Action: 
                - "s3:*"
              Effect: "Allow"
              Resource: 
                Fn::Join: 
                  - ""
                  - 
                    - "arn:aws:s3:::"
                    - !Ref app
                    - "/*"
              Principal: !GetAtt BucketUser.Arn
      DependsOn: BucketUser
Outputs:
  AccessKeyId:
    Value: !Ref UserAccessKey
  AccessKeySecret:
    Value: !GetAtt UserAccessKey.SecretAccessKey
  BucketURL:
    Value: !GetAtt Bucket.WebsiteURL
  BucketUserArn:
    Value: !GetAtt BucketUser.Arn

工作模板:

AWSTemplateFormatVersion: "2010-09-09"
Description: "Creates bucket with bucket policy"
#Metadata: 
Parameters:
  app:
    Type: String
    Description: (required) Application name (Also used for bucket name. Follow S3 bucket name conventions)
    Default: ymessage-bucket-test
Resources:
  BucketUser:
    Type: "AWS::IAM::User"
    Properties: 
      UserName: !Ref app
  UserAccessKey:
    Type: "AWS::IAM::AccessKey"
    Properties: 
      Status: Active
      UserName: !Ref app
    DependsOn: BucketUser
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref app
  BucketPolicy:
      Type: "AWS::S3::BucketPolicy"
      Properties: 
        Bucket: !Ref app
        PolicyDocument: 
          Statement: 
            - 
              Action: 
                - "s3:*"
              Effect: "Allow"
              Resource: 
                Fn::Join: 
                  - ""
                  - 
                    - "arn:aws:s3:::"
                    - !Ref app
                    - "/*"
              Principal: "*"
      DependsOn: BucketUser
Outputs:
  AccessKeyId:
    Value: !Ref UserAccessKey
  AccessKeySecret:
    Value: !GetAtt UserAccessKey.SecretAccessKey
  BucketURL:
    Value: !GetAtt Bucket.WebsiteURL
  BucketUserArn:
    Value: !GetAtt BucketUser.Arn

Answer 1

发现问题:在 BucketPolicy 中它可以直接接受 Principal: "*" 但如果你想使用 arn，请执行以下操作:

Principal: 
  AWS: 
    - !GetAtt BucketUser.Arn