Cloudformation：替換 map 鍵中的變量

Question

我有一個這樣定義的角色：

AWSTemplateFormatVersion: "2010-09-09"


Parameters:
  AWSAccountId:
    Type: String

  OidcProvider:
    Type: String

  AppNamespace:
    Type: String
 
 AppServiceAccountName:
    Type: String


Resources:
  CloudWatchRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Federated:
                - !Join ["", [ "arn:aws:iam::", !Ref AWSAccountId, ":oidc-provider/", !Ref OidcProvider ] ]
            Action:
              - "sts:AssumeRoleWithWebIdentity"
            Condition:
              StringEquals:
                !Sub ${OidcProvider}:sub: "system:serviceaccount:${AppNamespace}:${AppServiceAccountName}"

我的挑戰是如何替換 StringEquals 部分中的參數。 一切都在 Federated 塊中工作。 但是在 StringEquals 塊中，我無法讓 join 或 sub 工作。

按原樣使用代碼，我收到錯誤消息：

An error occurred (ValidationError) when calling the CreateStack operation: 
Template format error[/Resources/CloudWatchRole/Properties/AssumeRolePolicyDocument/
Statement/0/Condition/StringEquals] map keys must be strings; received a map instead

所以，我想我的問題是如何替換 map 的鍵中的變量。UserData 也沒有幫助。

Answer 1

您的問題出在Federated而不是StringEquals上。 Federated值需要是string ，但您將其定義為Map 。 請在!Join之前刪除- 。

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  AWSAccountId:
    Type: String
  OidcProvider:
    Type: String
  AppNamespace:
    Type: String
  AppServiceAccountName:
    Type: String

Resources:
  CloudWatchRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument: !Sub
        - |
          {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Federated": "${IamOidcProviderArn}"
                    },
                    "Action": "sts:AssumeRoleWithWebIdentity",
                    "Condition": {
                        "StringEquals": {
                            "${OidcProvider}:sub": "system:serviceaccount:${AppNamespace}:${AppServiceAccountName}"
                        }
                    }
                }
            ]
          }
        - IamOidcProviderArn: !Join
          - ''
          - - 'arn:aws:iam::'
            - !Ref AWSAccountId
            - ':oidc-provider/'
            - !Ref OidcProvider
          OidcProvider: !Ref OidcProvider
          AppNamespace: !Ref AppNamespace
          AppServiceAccountName: !Ref AppServiceAccountName