[英]Does AWS CloudFormation support Tags Property Attribute for AWS::EC2::VPCEndpoint
[英]AWS CloudFormation Substitute VPCEndPoint Policy
我想创建 S3 存储桶并为此存储桶创建端点。
我将资源定义如下:
myS3Bucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub 'my-${ENVL}-${AWS::AccountId}'
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: AES256
DeletionPolicy: Delete
myS3VpcEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument: '{
"Version":"2012-10-17",
"Statement":[{
"Effect":"Allow",
"Principal": "*",
"Action":["s3:*"],
"Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"]
}]
}'
RouteTableIds:
- !Ref myIntRouteTable
- !Ref myPriRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
VpcId: !Ref myVPC
如何在策略 object 中引用我的 s3 存储桶。
"资源":.Sub ["${!GetAtt myS3Bucket.Arn}/*"]不工作。
谢谢, 帕里
这很简单,我又看了一次 YAML。
PolicyDocument: !Sub
- '{
"Version":"2008-10-17",
"Statement":[{
"Effect":"Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": ["arn:aws:s3:::${s3Bucket}", "arn:aws:s3:::${s3Bucket}/*"]
}]
}'
- {s3Bucket: !Sub "my-${ENVL}-${AWS::AccountId}"}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.