使用cloudformation更新S3存储桶的IAM策略

Question

We have a use case: Update the IAM policy as new bucket is created.

New bucket is created using cloudformation template.

Is it possible to update the current IAM policy eg add a new Resource value using cloudformation ?

Answer 1

You have to configure the SNS topic to your cloudformation, the cloudformation will publish to the SNS topic. Configure the SNS to invoke the Lambda function that will update your IAM policy.

Provide the required permissions to your

CloudFormation -> to send notification to SNS

SNS -> to Invoke your lambda

Lambda Function -> To Update IAM Policy

Answer 2

或者，您可以创建一个有权访问所有S3存储桶的组或角色，然后为每个S3存储桶创建一个新的IAM策略，并使用AWS::IAM::Policy的Groups或Roles属性分配给该组或角色AWS::IAM::Policy资源。