时间戳

首页 > 解决方案 > AWS Cloudformation how from S3 bucket names CommaDelimitedList make list of ARN - semi for loop cycle

amazon-cloudformation - AWS Cloudformation how from S3 bucket names CommaDelimitedList make list of ARN - semi for loop cycle

问题描述

Here are parameters - S3 bucket names list:

Parameters:
  S3BucketNames:
    Description: Enter S3 Bucket Names
    Type: CommaDelimitedList
    Default: my-first-bucket,testing-bucket,codepipeline-bucket

Need to make policy IAM Policy for GetObject, PutObject operations, when arn has to be in the following format suitable for IAM policy:

arn:${Partition}:s3:::${BucketName}/${ObjectName}

In my example it should look like:

"arn:aws:s3:::my-first-bucket/*",
"arn:aws:s3:::testing-bucket/*",
"arn:aws:s3:::codepipeline-bucket/*"

标签： amazon-cloudformation

解决方案

I had to think a bit how I can pull it off, obvious when you know it, but maybe will be helpfull for someone:

  S3RolePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: DemoPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetObject
            Resource: !Split
            - ","
            - !Sub
              - arn:aws:s3:::${S3Middle}/*
              - S3Middle: !Join [ "/*,arn:aws:s3:::" , !Ref S3BucketNames ]

It's not a full CloudFormation template - just sample peace

推荐阅读