CFn:使用！如果要将多个主体添加到一个语句中

Question

我有以下模板定义了一个不起作用的IAM策略：

RoleName: 'ABCRole'
AssumeRolePolicyDocument:
Statement:
- Action: ['sts:AssumeRole']
Effect: Allow
Principal:
AWS:
- 1234567890 # Some AWS account
- !If
- !And
- !Condition Condition1
- !Condition Condition2
- arn:aws:iam::11111111111111:role/ABCDE_Role # first role
- arn:aws:iam::22222222222222:role/ABCDE_Role # second role (different account number)
- !Ref AWS:NoValue

我正在努力实现这一点：当Condition1和Condition2都为真时，我将能够将arn:aws:iam::11111111111111:role/ABCDE_Role和arn:aws:iam::22222222222222:role/ABCDE_Role附加为两个额外的主体。否则，什么也不做——将1234567890作为唯一的主体。

请注意，arn:aws:iam::11111111111111:role/ABCDE_Role和arn:aws:iam::22222222222222:role/ABCDE_Role只是与aws帐户不同，所以也许我可以用!Sub来代替帐号？有点像：

for account in [11111111111111, 22222222222222]:
!Sub arn:aws:iam::${account}:role/ABCDE_Role 

我应该如何修改上面的模板？提前谢谢！

Answer 1

我认为是因为！如果条件预期，遵循aws的文档，格式为：

!If [condition_name, value_if_true, value_if_false]

如果你检查你的模板，你有四个元素，而不是三个。

此外，伪参数为(带双精度：(：

AWS::NoValue

因此，当条件为True时，添加所需的两个帐户的可能解决方案可以是尝试添加一个新条件，该条件将您已经具有的条件1和条件2与！和功能，像这样：

Conditions:
Condition1: your condition
Condition2: your condition
ConditionCombined: !And [!Condition Condition1, !Condition Condition2]
Resources:
Role1:
Type: AWS::IAM::Role
Properties: 
RoleName: 'ABCRole'
AssumeRolePolicyDocument:
Statement:
- Action: ['sts:AssumeRole']
Effect: Allow
Principal:
AWS:
- 1234567890 # Some AWS account
- !If
- ConditionCombined
- arn:aws:iam::11111111111111:role/ABCDE_Role # first role
- !Ref AWS::NoValue
- !If
- ConditionCombined
- arn:aws:iam::22222222222222:role/ABCDE_Role # second role (different account number)
- !Ref AWS::NoValue