我有一个输入参数，它是一组角色名称：
Parameters:
UserRoles:
Type: CommaDelimitedList
Default: ""
Principal:
AWS:
- !Join
- ''
- - 'arn:aws:iam::'
- !Ref 'AWS::AccountId'
- ':role/'
- !Ref UserRole
但现在我希望对于不确定数量的角色进行操作。因此，我需要一些"Fn::Map"函数来处理字符串列表，以将角色名称转换为Arns。
这种操作可行吗？
使用 CloudFormation 原生结构没有立即的解决方案，但您可以通过使用宏来构建一个解决方案。
下面是一个完整的示例。总之，该解决方案有两个组件：
以下示例解答了这里提出的直接问题，但对于想要进行自定义字符串操作的一般读者也应该有用。
构建自定义字符串操作宏
以下模板创建由 Lambda 函数支持的宏。调用宏时会执行 Lambda 函数。
宏（因此是 Lambda）将逗号分隔的角色列表（例如 role1,role2）和 AWS 帐户 ID 作为输入，并返回格式化的 IAM 角色（例如 [arn:aws:iam::12345678910:role/role1,arn:aws:iam::12345678910:role/role2]）。
这是完整的模板：
AWSTemplateFormatVersion: 2010-09-09
Resources:
TransformExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service: [lambda.amazonaws.com]
Action: ['sts:AssumeRole']
Path: /
Policies:
- PolicyName: root
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: ['logs:*']
Resource: 'arn:aws:logs:*:*:*'
TransformFunction:
Type: AWS::Lambda::Function
Properties:
Code:
ZipFile: |
import traceback
def handler(event, context):
response = {
"requestId": event["requestId"],
"status": "success"
}
try:
role_names = event["params"]["RoleNames"]
account_id = str(event["params"]["AccountId"])
role_formatter = lambda role : "arn:aws:iam::" + account_id + ":role/" + role
formatted_roles = list(map(role_formatter,role_names))
response["fragment"] = formatted_roles
except Exception as e:
traceback.print_exc()
response["status"] = "failure"
response["errorMessage"] = str(e)
return response
Handler: index.handler
Runtime: python3.6
Role: !GetAtt TransformExecutionRole.Arn
TransformFunctionPermissions:
Type: AWS::Lambda::Permission
Properties:
Action: 'lambda:InvokeFunction'
FunctionName: !GetAtt TransformFunction.Arn
Principal: 'cloudformation.amazonaws.com'
Transform:
Type: AWS::CloudFormation::Macro
Properties:
Name: 'FormatIamRoles'
Description: Provides various string processing functions
FunctionName: !GetAtt TransformFunction.Arn
使用自定义宏进行字符串操作
下面的模板展示了如何使用先前部署的自定义宏来创建一个S3存储桶的策略。
该模板需要输入S3存储桶的名称和逗号分隔的IAM角色名称列表。
自定义宏（参见'Fn::Transform'的用法）需要输入逗号分隔的IAM角色名称列表和AWS账户ID。它返回格式化后的IAM角色列表，并将其用于为指定的S3存储桶创建策略。
Parameters:
UserRoles:
Type: CommaDelimitedList
Default: "role1,role2"
MyBucket:
Type: String
Default: my-bucket
Resources:
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Version: 2012-10-17
Statement:
- Sid: MyRoleAllow
Effect: Allow
Principal:
AWS:
'Fn::Transform':
- Name: 'FormatIamRoles'
Parameters:
RoleNames: !Ref UserRoles
AccountId: !Ref 'AWS::AccountId'
Action:
- s3:*
Resource: !Sub arn:aws:s3:::${MyBucket}/*
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
MyCommaSeparatedParameters:
Type: String
Default: FirstParam,SecondParam,ThirdParam
Conditions:
# See the additional commas? That's to prevent erroring out when there's less than 3 items in the list
ConditionParam0: !Not [!Equals [!Select [0, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']], '']]
ConditionParam1: !Not [!Equals [!Select [1, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']], '']]
ConditionParam2: !Not [!Equals [!Select [2, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']], '']]
Resources:
Ec2InstanceIamDefaultPolicy:
Type: "AWS::IAM::ManagedPolicy"
Properties:
ManagedPolicyName: "SomeRandomPolicy"
PolicyDocument:
Version: "2012-10-17"
Statement:
- Effect: "Allow"
Action:
- "s3:GetObject"
Resource:
- !If
- ConditionParam0
- !Sub
- "arn:aws:s3:::vopak-infra-automations/${param}"
- param: !Select [0, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']]
- !Ref "AWS::NoValue"
- !If
- ConditionParam1
- !Sub
- "arn:aws:s3:::vopak-infra-automations/${param}"
- param: !Select [1, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']]
- !Ref "AWS::NoValue"
- !If
- ConditionParam2
- !Sub
- "arn:aws:s3:::vopak-infra-automations/${param}"
- param: !Select [2, !Split [',', !Sub '${MyCommaSeparatedParameters},,,']]
- !Ref "AWS::NoValue"