AWS CDK 如何在 IAM 策略中包含委托人？

Question

您好，我正在研究 AWS CDK。 我正在嘗試創建基於資源的策略。 下面是我的雲形成模板。

MWSECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "location/location-service"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          - Sid: CurrentAccountPush
            Effect: Allow
            Principal:
              AWS:
                - 'arn:aws:iam::1234:root'  # dev
                - 'arn:aws:iam::1234:root'  # nonprod
                - 'arn:aws:iam::1234:root'  # prod
            Action:
              - 'ecr:GetDownloadUrlForLayer'
              - 'ecr:PutImage'
              - 'ecr:InitiateLayerUpload'
              - 'ecr:UploadLayerPart'
              - 'ecr:CompleteLayerUpload'

下面我正在嘗試使用 CDK 創建相同的內容。

 ECRRepository = ecr.Repository(self, id = "ECR", repository_name = "location/location-service");
        ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
            principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
        ));


        ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            #principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
            actions=["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]
        ));

        ECRRepository.add_lifecycle_rule(description="Image retention",  max_image_count=100, rule_priority=1);

這導致以下錯誤

錯誤：預期的對象引用，得到“arn:aws:iam::123:root”

有人可以幫助我使用 python 編寫正確的語法嗎？ 任何幫助，將不勝感激。 謝謝

Answer 1

principals需要是IPrincipal的列表而不是strings

ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
            principals=[iam.ArnPrincipal("aws:iam::1234:root")]
        ));