Is it possible to override AWS SAM policy template placeholder variables

Question

I am currently trying to add both the AWS SAM policy templates KMSDecryptPolicy & KMSEnecryptPolicy to my config yml but the KMS key is in a different account and I would need cross account access to do this.

However when using the above mentioned policy templates I can only pass the KeyId and not the AWS account number which is a placeholder variable.

I am trying to do this using the AWS SAM policy templates.

Would appreciate any support on this.

This is an example of how my current policies look like.

      Policies:
    - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
    - DynamoDBCrudPolicy:
        TableName: !Ref InvoiceFeaturesTable
    - S3CrudPolicy:
        BucketName: !Ref InvoiceFeaturesBucket

example code

Answer 1

Both KMSDecryptPolicy and KMSEnecryptPolicy uses ${AWS::AccountId} which defaults to the current AWS account and you cannot override it via policy templates. You ONLY can pass KeyId : Reference

What you can simply do is to copy the policy template into your SAM template as inline policy and modify it as required. Reference