Cloudformation参数作为逻辑ID

Question

I am trying to create a IAM role using cloudFormation. There is a parameter that I want to include in the role name. My cloudformation script has the following:

"Resources" : { 
    "TestRole" : {
        "Type" : "AWS::IAM::Role",
        "Properties" : {
            "AssumeRolePolicyDocument": {
                "Version" : "2012-10-17",
                "Statement": [ {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": [ "ec2.amazonaws.com" ]
                    },
                    "Action": [ "sts:AssumeRole" ]
                }]
            }
        }
    }
}

My cloudformation stack is named role-test. This creates a IAM role with the name role-test-TestRole- RandomString . Is there a way to have the rolename to be exactly what I specify in the parameter?

Answer 1

It doesn't look like that'll actually work since each resource needs to have a unique ID and this ID is generated by AWS::CF.

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html

From what I understand from talking to AWS folks in the past, this is done like this because each resource needs a uniquely identifiable ID.

This ID is used when calling something like this:

{"Fn::GetAtt" : ["TestRole", "Arn"] }

Hope that helps.

Answer 2

It is already possible to specify a custom name for IAM roles in CF: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-rolename

A name for the IAM role. For valid values, see the RoleName parameter for the CreateRole action in the IAM API Reference . If you don't specify a name, AWS CloudFormation generates a unique physical ID and uses that ID for the group name.

Important

If you specify a name, you cannot do updates that require this resource to be replaced. You can still do updates that require no or some interruption. If you must replace the resource, specify a new name.

If you specify a name, you must specify the CAPABILITY_NAMED_IAM value to acknowledge your template's capabilities. For more information, see Acknowledging IAM Resources in AWS CloudFormation Templates .

Warning

Naming an IAM resource can cause an unrecoverable error if you reuse the same template in multiple regions. To prevent this, we recommend using Fn::Join and AWS::Region to create a region-specific name, as in the following example: {"Fn::Join": ["", [{"Ref": "AWS::Region"}, {"Ref": "MyResourceName"}]]} .

Though, it needs an extra capability as it is stated in the documentation.