Question

我有一个CloudFormation模板，它创建一个AWS::Events::Rule和一个AWS::SSM::Document。我需要为Targets提供SSM::Rule的列表，但是每个目标都希望有ARN：

mySSMDocument:
  Type: AWS::SSM::Document
  Properties:
    DocumentType: 'Command'
    Content:
      schemaVersion: '2.2'
      description: "Code that will be run on EC2"
      mainSteps:
        - action: "aws:runShellScript"
          name: runShellScript
          inputs:
            runCommand:
              - 'Some command to execute'
myEventRule:
  Type: AWS::Events::Rule
  Properties:
    Description: "A description for the Rule."
    EventPattern: 
      source:
        - "aws.autoscaling"
      detail-type:
        - "EC2 Instance-terminate Lifecycle Action"
      detail:
        AutoScalingGroupName:
          - !Ref 'someAutoScalingGroupInThisTemplate'
    RoleArn: 'some role ARN'
    State: "ENABLED"
    Targets:
      - Id: "some-unique-id"
        Arn: <-- This is the value that I need to fill in.
        RunCommandParameters:
          RunCommandTargets:
            - Key: "tag: Name"
              Values:
                - 'The name of the EC2 machine'

我认为我需要将<-- This is the value that I need to fill in.的{{1}}替换为ARN，但是我看不到从模板本身中检索此值的任何方法。 The documentation未在mySSMDocument上指定任何允许获取GetAtt的{{1}}功能。有人知道如何解决这个问题吗？

Answer 1

这是文档的ARN模式

arn：$ {Partition}：ssm：$ {Region}：$ {Account}：document / $ {DocumentName}

示例：

arn：aws：ssm：us-east-2：12345678912：document / demoooo

您可以使用Ref函数获取文档名称，然后使用Sub创建最终的ARN

引用：https://docs.aws.amazon.com/IAM/latest/UserGuide/list_awssystemsmanager.html#awssystemsmanager-resources-for-iam-policies

Answer 2

flex: 1

您可以使用ARN format for AWS::SSM::Document，return Value for AWS::SSM::Document和Pseudo Parameters for Partition, Region, and AccountId

生成Sub intrinsic function

如何在CloudFormation中获取SSM文档的ARN？

2 个答案: