AWS CloudFormation Substitute VPCEndPoint Policy

Question

I want to create S3 bucket and create endpoint for this bucket.

I defined the resources as below:

myS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'my-${ENVL}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
    DeletionPolicy: Delete
  myS3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument: '{
        "Version":"2012-10-17",
        "Statement":[{
          "Effect":"Allow",
          "Principal": "*",
          "Action":["s3:*"],
          "Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"]
        }]
      }'
      RouteTableIds:
        - !Ref myIntRouteTable
        - !Ref myPriRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref myVPC

How do I refer my s3 bucket in policy object.

"Resource":.Sub ["${!GetAtt myS3Bucket.Arn}/*"] is not working.

Thanks, Pari

Answer 1

It was easy, I had a look at YAML one more time.

PolicyDocument: !Sub 
    - '{
        "Version":"2008-10-17",
        "Statement":[{
        "Effect":"Allow",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": ["arn:aws:s3:::${s3Bucket}", "arn:aws:s3:::${s3Bucket}/*"]
        }]
    }'
    - {s3Bucket: !Sub "my-${ENVL}-${AWS::AccountId}"}