AWS CloudFormation：如何在 AWS::IAM::Policy 中引用另一个堆栈中定义的角色

Question

Cloudformation 堆栈 1：

AWSTemplateFormatVersion: 2010-09-09
Metadata:
  'AWS::CloudFormation::Designer':
    c311c237-d7a4-4fac-a838-8a5a37a4b083:
      size:
        width: 60
        height: 60
      position:
        x: 127
        'y': 160
      z: 0
Resources:
  ECSRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs.amazonaws.com]
            Action: ['sts:AssumeRole']
      Path: /
      Policies:
        - PolicyName: ecs-service
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - 'ec2:AttachNetworkInterface'
                  - 'ec2:CreateNetworkInterface'
                  - 'ec2:CreateNetworkInterfacePermission'
                  - 'ec2:DeleteNetworkInterface'
                  - 'ec2:DeleteNetworkInterfacePermission'
                  - 'ec2:Describe*'
                  - 'ec2:DetachNetworkInterface'
                  - 'elasticloadbalancing:DeregisterInstancesFromLoadBalancer'
                  - 'elasticloadbalancing:DeregisterTargets'
                  - 'elasticloadbalancing:Describe*'
                  - 'elasticloadbalancing:RegisterInstancesWithLoadBalancer'
                  - 'elasticloadbalancing:RegisterTargets'
                Resource: '*'

Outputs:
  ECSTaskRoleId:
    Description: ECSRoleId
    Value: !GetAtt
      - ECSRole
      - RoleId
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', ECSTaskRoleId ] ]
  ECSTaskRoleIdECSRole:
    Description: The ARN of the ECS role
    Value: !GetAtt 'ECSRole.Arn'
    Export:
      Name: !Join [ ':', [ !Ref 'AWS::StackName', 'ECSRole' ] ]

**

堆栈 2：**

Resources:
  SNSRWPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      Role :
        - Fn::ImportValue: 'testk2:ECSTaskRoleId'
      PolicyName: test-snspolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - 'sns:Publish'
              - 'kms:Decrypt'
              - 'kms:GenerateDataKey'
     
    Metadata:
      'AWS::CloudFormation::Designer':
        id: c5c7c890-30c7-470d-9233-57b8bd630856

我收到以下错误

找不到名为 AROA3RRAFXNEDPVQKOLIW 的角色。 （服务：AmazonIdentityManagement；状态代码：404；错误代码：NoSuchEntity；请求 ID：d5ad937f-94c3-458e-a803-0c37258e05f1；代理：null）

如何导入 IAM::Role 以在另一个堆栈中附加策略？ CloudFormation 初学者:(

Answer 1

问题是 Type: 'AWS::IAM::Policy' property Roles 需要 Role name而不是 role ID 。

CloudFormation 对名称和 ID 非常敏感。 因此，请始终确保您提及正确的财产。

Outputs:
  ECSTaskRole:
    Description: The ECSRole name
    Value: !Ref ECSRole

因此，在导出时，它将导出名称，而 importValue 将正确采用该名称。

AWS::IAM::策略角色