如何从 cloudformation 模板中的参数文件传递公钥？

Question

I have defined the following a Cloudformation template, where I want to pass Public Key from a parameter file. The 'MyPublicKey' variable is of string type. I refer to this variable by using

EncodedKey !Ref MyPublicKey

under PublicKeyConfig as seen below.

AWSTemplateFormatVersion: "2010-09-09"

  Parameters:
    MyPublicKey:
      Type: String
      Description: 'Public key for some purpose'
      NoEcho: true

  Resources:
    CloudfrontPublicKey:
      Type: AWS::CloudFront::PublicKey
      Properties:
        PublicKeyConfig:
          CallerReference: 'some-caller-reference'
          Comment: 'Public key for signed url'
          Name: 'cloudfront-public-key'
          EncodedKey: !Ref MyPublicKey

    ...

The parameter.json file looks something like this. The public key was multi line in the original.pem file but I have added new lines character '\n' in the string whereever there is a line break.

[
  {
    "ParameterKey": "MyPublicKey",
    "ParameterValue": "-----BEGIN PUBLIC KEY-----\naaaa\nbbbb\n-----END PUBLIC KEY-----"
  },
]
 

When trying to update the stack, I get the following error:

Invalid request provided: AWS::CloudFront::PublicKey

It does not seem to be able to import the public key.

Answer 1

Based on comments an extra \n char was needed when passing the value and Ref should be replaced with Sub function for placing the string.

  Resources:
    CloudfrontPublicKey:
      Type: AWS::CloudFront::PublicKey
      Properties:
        PublicKeyConfig:
          CallerReference: 'some-caller-reference'
          Comment: 'Public key for signed url'
          Name: 'cloudfront-public-key'
          EncodedKey: !Sub "${MyPublicKey}"

Below is the inline key example:

Generate keys:

openssl genrsa -out private_key.pem 2048
openssl rsa -pubout -in private_key.pem -out public_key.pem

Cloudformationt template:

AWSTemplateFormatVersion: "2010-09-09"
Resources:
  CloudfrontPublicKey:
    Type: AWS::CloudFront::PublicKey
    Properties:
      PublicKeyConfig:
        CallerReference: 'some-caller-reference'
        Comment: 'Public key for signed url'
        Name: 'cloudfront-public-key'
        EncodedKey: |
          -----BEGIN PUBLIC KEY-----
          MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsG0grTw5uHbO4CkFVyqN
          lKLGd9ZJrj6l68QU20SzrF7jgQtzE7VKfHxWfzE5FDKF1qKVLT0mURjlRfRPUXaT
          sZYsnKv+cTYkraewdLqbVuN7JII2D/cEXTYRn7849kGKycl3YMXeJeBStbLSPWfh
          MNJZnlFnEX6DkYtwk0Ae0bQ3WT1Be/Xhe4pqSQsnU+InSDkIfA+4UTRLa0kTCgON
          8BjcNloJE3NbLYshQPconb8pA+3jjkMF0QAH6rtc452G7CuS3KBfVQwWUeWE77kK
          wQQir6YFvKP3pG8Ls55FxXBTCCNJl5LZcHt1D0cZmuoSLJj2mVzJgKGyLTdoIwAW
          6QIDAQAB
          -----END PUBLIC KEY-----

Listing keys:

aws cloudfront list-public-keys|jq .PublicKeyList.Items[1]

Output:

{
  "Id": "08ZCTRKADSADASDAS",
  "Name": "cloudfront-public-key",
  "CreatedTime": "2021-02-27T10:25:43.076Z",
  "EncodedKey": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsG0grTw5uHbO4CkFVyqN\nlKLGd9ZJrj6l68QU20SzrF7jgQtzE7VKfHxWfzE5FDKF1qKVLT0mURjlRfRPUXaT\nsZYsnKv+cTYkraewdLqbVuN7JII2D/cEXTYRn7849kGKycl3YMXeJeBStbLSPWfh\nMNJZnlFnEX6DkYtwk0Ae0bQ3WT1Be/Xhe4pqSQsnU+InSDkIfA+4UTRLa0kTCgON\n8BjcNloJE3NbLYscZmuoSLJj2mVzJgKGyLTdoIwAW\n6QIDAQAB\n-----END PUBLIC KEY-----\n",
  "Comment": "Public key for signed url"
}

Public key creation in AWS cloudformation giving following error: Invalid request provided: AWS::CloudFront::PublicKey already answered.