如何在 cloudformation 中引用 AWS 托管策略 arn？

Question

I am going to create an IAM user with cloudformation and need to attach an AWS managed policy AWSAppSyncInvokeFullAccess . I think I should use the managed policy like below code:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Ref AWSAppSyncInvokeFullAccess
        - !Ref AWSLambdaBasicExecutionRole

but it doesn't work since AWSAppSyncInvokeFullAccess is from AWS not from this template. What is the correct way to reference the policies?

Answer 1

These are existing AWS-managed policies. So you should use their full ARN , which you can get from IAM console:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSAppSyncInvokeFullAccess
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

Update

Or to make it partition independent:

Resources:
  publisherUser:
    Type: AWS::IAM::User
    Properties:
      UserName: userName
      ManagedPolicyArns: 
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/AWSAppSyncInvokeFullAccess"
        - !Sub "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"

Answer 2

以防万一有人想知道您可以通过单击策略页面上的策略名称找到所有 IAM 策略的 ARN。