如何在CloudFormation中将字符串列表作为参数传递？

Question

我有一个嵌套的CloudFormation模板，该模板从其根模板接受许多参数来对其进行配置。目前，我仅传递简单的字符串参数，但现在我需要将S3存储桶ARN列表传递到子模板上。

ChildLambdaStack:
  Type: AWS::CloudFormation::Stack
  Properties:
    Parameters:
      AwsRegion: !Ref AwsRegion
      Environment: !Ref Environment
      Product: !Ref Product
      S3Buckets: "arn:aws:s3:::bucket1,arn:aws:s3:::bucket2"
    TemplateURL: "https://s3.amazonaws.com/child-template.yml"

然后在子模板中，我有这个

AWSTemplateFormatVersion: "2010-09-09"
Description: "Child Lambda"

Parameters:
  AwsRegion:
    Type: String
  Environment:
    Type: String
  Product:
    Type: String
  S3Buckets:
    Type: String

Resources:
  DeployerPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action:
              - s3:PutObject
              - s3:GetObject
              - s3:DeleteObject
              - s3:CreateBucket
              - s3:DeleteBucket
              - s3:ListBucket
              - s3:PutBucketNotification
            Resource:
              - Fn::Split:
                - ","
                - !Ref S3Buckets

我的想法是，我要输入的S3存储桶ARN列表在子模板中像这样扩展

Resource:
  - arn:aws:s3:::bucket1
  - arn:aws:s3:::bucket2

但是当我运行模板时，它只会出错

Syntax errors in policy. (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument)

我尝试了其他变体，例如使用CommaDelimitedList参数类型，但没有任何效果。有没有简单的方法可以将字符串列表作为参数传递？

Answer 1

正如@MaiKaY指出的那样，@Liam Mayfair的代码中的缺陷Fn::Split是前面的-which 导致包含单个元素的列表是一个列表。固定代码看起来像

...
            Resource:
              Fn::Split:
                - ","
                - !Ref S3Buckets

更一般地说，您必须确保在使用时使用Stringnot的 Parameter 类型，因为它不会拆分.CommaDelimitedListFn::SplitCommaDelimitedList

• 如果你使用CommaDelimitedListwithFn::Split你会得到错误Template error: every Fn::Split object requires two parameters, (1) a string delimiter and (2) a string to be split or a function that returns a string to be split
• 如果你使用CommaDelimitedListnoFn::Split你会得到错误Syntax errors in policy

Answer 2

实际上有更好的方法。List<String>您可以在 CloudFormation 参数中使用该类型：

# ...
Parameters:
  S3Buckets:
    Type: List<String>
# ...

然后传递 S3 存储桶列表，就像以逗号分隔值一样：

# ...
ChildLambdaStack:
  Type: AWS::CloudFormation::Stack
  Properties:
    Parameters:
      AwsRegion: !Ref AwsRegion
      Environment: !Ref Environment
      Product: !Ref Product
      # Next line will be interpreted as a list
      S3Buckets: "arn:aws:s3:::bucket1,arn:aws:s3:::bucket2"
    TemplateURL: "https://s3.amazonaws.com/child-template.yml"
# ...

然后，您可以假设引用的参数的类型是列表。所以而不是：

# ...
Resource: !Split [",", !Ref S3Buckets]
# ...

你可以只使用：

# ...
Resource: !Ref S3Buckets
# ...

Answer 3

因为的返回值!Split是A list of string values.我将通过以下方式进行操作：

[...]
    Resource: !Split [",", !Ref S3Buckets]
[...]