Question

我想创建S3存储桶并为此存储桶创建端点。

我对资源的定义如下：

myS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'my-${ENVL}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
    DeletionPolicy: Delete
  myS3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument: '{
        "Version":"2012-10-17",
        "Statement":[{
          "Effect":"Allow",
          "Principal": "*",
          "Action":["s3:*"],
          "Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"]
        }]
      }'
      RouteTableIds:
        - !Ref myIntRouteTable
        - !Ref myPriRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref myVPC

如何在策略对象中引用我的s3存储桶。

“资源”：！Sub [“ $ {！GetAtt myS3Bucket.Arn} / *”] 不起作用。

谢谢，帕里

Answer 1

很简单，我又看了一次YAML。

PolicyDocument: !Sub 
    - '{
        "Version":"2008-10-17",
        "Statement":[{
        "Effect":"Allow",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": ["arn:aws:s3:::${s3Bucket}", "arn:aws:s3:::${s3Bucket}/*"]
        }]
    }'
    - {s3Bucket: !Sub "my-${ENVL}-${AWS::AccountId}"}

AWS CloudFormation替代VPCEndPoint策略

1 个答案: