amazon-web-services - 在 AWS Cloud Formation 中，如何在 IAM 策略中使用 Ref 指定两个资源？

Question

如果它们针对两个不同的资源，如何将两个相同的 IAM 策略合二为一。其中一项资源具有 Join 和 Ref。CloudFormation 模板中是否可以将以下两个策略合并为单个策略？

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource:
    !Join
      - ''
      - - 'arn:aws:s3:::'
        - !Ref TestBucketName
        - '/*'

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource: "arn:aws:s3:::SecondTestBucket/Download/*"

标签： amazon-web-servicesamazon-s3yamlamazon-cloudformationamazon-iam

Answer 1

您也可以使用!Sub 或 Fn::Sub代替Join下面的清晰代码。

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectAcl"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource:
    - !Sub arn:aws:s3:::${TestBucketName}/*
    - "arn:aws:s3:::SecondTestBucket/Download/*"