![](/img/trans.png)
[英]How can I ref a variable in ImportValue in cloudformation?
[英]How to ImportValue in trust relationship
我從另一個堆棧導出了一個值並嘗試以 cloudformation 角色導入“AssumeRolePolicyDocument”,嘗試了很多方法但出現以下錯誤
“語法錯誤 position (1,195)(服務:AmazonIdentityManagement;狀態代碼:400;錯誤代碼:MalformedPolicyDocument;請求 ID:b1b4b5ef-88ef-444b-8aa7-0548ce0002a6;代理:空)”
EksAutoscalerRole:
Type: AWS::IAM::Role
Properties:
RoleName: Eks-Autoscaler-Role
Path: "/"
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Federated:
'Fn::Sub':
- 'arn:aws:iam::1122334455:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/${oidc}'
- oidc:
"Fn::ImportValue": EksOidc
Action: 'sts:AssumeRoleWithWebIdentity'
Condition:
StringEquals:
'Fn::Sub':
- 'oidc.eks.us-east-1.amazonaws.com/id/${oidc}:sub: system:serviceaccount:kube-system:cluster-autoscaler'
- oidc:
"Fn::ImportValue": EksOidc
ManagedPolicyArns:
- !Ref EksAutoscalerPolicy
也嘗試了以下方法: 插入類似於插入參數的 CloudFormation ImportValue?
更新試過下面的代碼現在可以工作了。
EksAutoscalerRole:
Type: AWS::IAM::Role
Properties:
RoleName: Eks-Autoscaler-Role
Path: /
AssumeRolePolicyDocument:
"Fn::Sub":
- '{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "${EksAutoscalerProvider}"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"oidc.eks.${AWS::Region}.amazonaws.com/id/${oidcNo}:sub": "system:serviceaccount:kube-system:cluster-autoscaler"
}
}
}
]
}'
- oidcNo: !Select [0, !Split [".", !Select [1, !Split ["//", !GetAtt EksCluster.Endpoint]]]]
ManagedPolicyArns:
- !Ref EksAutoscalerPolicy
檢查你的縮進。 根據文檔,Sub function 應該像這樣縮進:
Fn::Sub:
- String
- Var1Name: Var1Value
Var2Name: Var2Value
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.