AWS CDK 如何在 IAM 策略中包含委托人?
AWS CDK How to include principals in IAM policy?
您好,我正在研究 AWS CDK。我正在尝试创建基于资源的策略。下面是我的云形成模板。
MWSECRRepository:
Type: AWS::ECR::Repository
Properties:
RepositoryName: "location/location-service"
RepositoryPolicyText:
Version: "2012-10-17"
Statement:
- Sid: CurrentAccountPush
Effect: Allow
Principal:
AWS:
- 'arn:aws:iam::1234:root' # dev
- 'arn:aws:iam::1234:root' # nonprod
- 'arn:aws:iam::1234:root' # prod
Action:
- 'ecr:GetDownloadUrlForLayer'
- 'ecr:PutImage'
- 'ecr:InitiateLayerUpload'
- 'ecr:UploadLayerPart'
- 'ecr:CompleteLayerUpload'
下面我尝试使用 CDK 创建相同的内容。
ECRRepository = ecr.Repository(self, id = "ECR", repository_name = "location/location-service");
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
));
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
#principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
actions=["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]
));
ECRRepository.add_lifecycle_rule(description="Image retention", max_image_count=100, rule_priority=1);
这会导致以下错误
Error: Expected object reference, got "arn:aws:iam::123:root"
谁能帮我用 python 写出正确的语法?任何帮助,将不胜感激。谢谢
principals
需要是 IPrincipal
而不是 strings
的列表
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
principals=[iam.ArnPrincipal("aws:iam::1234:root")]
));
您好,我正在研究 AWS CDK。我正在尝试创建基于资源的策略。下面是我的云形成模板。
MWSECRRepository:
Type: AWS::ECR::Repository
Properties:
RepositoryName: "location/location-service"
RepositoryPolicyText:
Version: "2012-10-17"
Statement:
- Sid: CurrentAccountPush
Effect: Allow
Principal:
AWS:
- 'arn:aws:iam::1234:root' # dev
- 'arn:aws:iam::1234:root' # nonprod
- 'arn:aws:iam::1234:root' # prod
Action:
- 'ecr:GetDownloadUrlForLayer'
- 'ecr:PutImage'
- 'ecr:InitiateLayerUpload'
- 'ecr:UploadLayerPart'
- 'ecr:CompleteLayerUpload'
下面我尝试使用 CDK 创建相同的内容。
ECRRepository = ecr.Repository(self, id = "ECR", repository_name = "location/location-service");
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
));
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
#principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
actions=["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]
));
ECRRepository.add_lifecycle_rule(description="Image retention", max_image_count=100, rule_priority=1);
这会导致以下错误
Error: Expected object reference, got "arn:aws:iam::123:root"
谁能帮我用 python 写出正确的语法?任何帮助,将不胜感激。谢谢
principals
需要是 IPrincipal
而不是 strings
ECRRepository.add_to_resource_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
principals=[iam.ArnPrincipal("aws:iam::1234:root")]
));