CommaDelimitedList的AWS Cloudformation组合，fn:如果和fn:选择

Question

我正在尝试创建一个cfn堆栈。模板从参数部分获取一个/两个值作为输入。如果我在资源部分中传递来自参数相同读取的两个值，则工作正常。但如果我超过一个，它就坏了。

用例：-我想从参数中传递两个值，并在iam策略中读取它们。如果用户传递了一个值，则它应该使用{"Ref"："AWS:：NoValue"}。但我一直在获取

模板错误：Fn:：Select无法选择索引1中不存在的值

这是模板-

{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Template creates a IAMUser and attach a ListALLBuckets/ReadOnly Access Policy to it.",
"Parameters": {
"UserName": {
"Type": "String",
"Description": "Enter User Name"
},
"S3Bucket": {
"Type": "CommaDelimitedList",
"Description": "Select Bucket Name to Associate with the policy",
"Default": ""
}
},
"Conditions": {
"CreateSomeResource": {
"Fn::Not": [{
"Fn::Equals": [{
"Fn::Join": [
"",
{
"Ref": "S3Bucket"
}
]
},
""
]
}]
}
},
"Resources": {
"SomeUserName": {
"Type": "AWS::IAM::User",
"Properties": {
"UserName":  {  "Ref": "UserName"}
}
},
"SomeUserPolicy": {
"Type": "AWS::IAM::Policy",
"Properties": {
"Groups": [],
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [{
"Sid": "ListAllBuckets",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
}, {
"Sid": "ReadOnlyAccess",
"Effect": "Allow",
"Action": [
"s3:GetBucketPolicyStatus",
"s3:GetBucketTagging",
"s3:GetBucketLocation",
"s3:GetBucketPolicy",
"s3:GetObject"
],
"Resource": [
{
"Fn::If": [
"CreateSomeResource",
{
"Fn::Join": ["", ["arn:aws:s3:::",
{
"Fn::Select": ["0",
{
"Ref": "S3Bucket"
}
]
}
]]
},
{"Ref" : "AWS::NoValue"}
]
},
{
"Fn::If": [
"CreateSomeResource",
{
"Fn::Join": ["", ["arn:aws:s3:::",
{
"Fn::Select": ["1",
{
"Ref": "S3Bucket"
}
]
}
]]
},
{"Ref" : "AWS::NoValue"}
]
}
]
}
]
},
"PolicyName": "ReadOnly",
"Users": [{
"Ref": "SomeUserName"
}]
}
}
},
"Outputs": {
"UserName": {
"Description": "Name of the Created User",
"Value": {
"Ref": "UserName"
}
}
}
}

Answer 1

如果S3Bucket只有一个值，则为：

"Fn::Select": ["1",
{
"Ref": "S3Bucket"
}

显然是无效的。遗憾的是，你有CreateSomeResource条件并不重要。无论条件为true还是false，select都必须有效。

最简单的解决方案可能是将bucket作为两个独立的参数传递，S3Bucket1和S3Bucket2，并为它们中的每一个都有相应的条件。