AWS CloudFormation 替代 VPCEndPoint 策略

Question

我想创建 S3 存储桶并为此存储桶创建端点。

我定义的资源如下：

myS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'my-${ENVL}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
    DeletionPolicy: Delete
  myS3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument: '{
        "Version":"2012-10-17",
        "Statement":[{
          "Effect":"Allow",
          "Principal": "*",
          "Action":["s3:*"],
          "Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"]
        }]
      }'
      RouteTableIds:
        - !Ref myIntRouteTable
        - !Ref myPriRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref myVPC

如何在策略对象中引用我的 s3 存储桶。

"Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"] 不工作。

谢谢，帕丽

Answer 1

很简单，我又看了一遍 YAML。

PolicyDocument: !Sub 
    - '{
        "Version":"2008-10-17",
        "Statement":[{
        "Effect":"Allow",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": ["arn:aws:s3:::${s3Bucket}", "arn:aws:s3:::${s3Bucket}/*"]
        }]
    }'
    - {s3Bucket: !Sub "my-${ENVL}-${AWS::AccountId}"}