'CFn: Use !If to add multiple Principals to a statement
I have the following template defining a IAM policy which is not working:
RoleName: 'ABCRole'
AssumeRolePolicyDocument:
Statement:
- Action: ['sts:AssumeRole']
Effect: Allow
Principal:
AWS:
- 1234567890 # Some AWS account
- !If
- !And
- !Condition Condition1
- !Condition Condition2
- arn:aws:iam::11111111111111:role/ABCDE_Role # first role
- arn:aws:iam::22222222222222:role/ABCDE_Role # second role (different account number)
- !Ref AWS:NoValue
I am trying to achieve that: when both Condition1 and Condition2 are true, I will be able to attach arn:aws:iam::11111111111111:role/ABCDE_Role and arn:aws:iam::22222222222222:role/ABCDE_Role as two additional principals. Otherwise, do nothing -- having 1234567890 as the only principal.
Please note that, arn:aws:iam::11111111111111:role/ABCDE_Role and arn:aws:iam::22222222222222:role/ABCDE_Role are only different from the aws account, so maybe I could use !Sub to replace the the account number? Somewhat like:
for account in [11111111111111, 22222222222222]:
!Sub arn:aws:iam::${account}:role/ABCDE_Role
How should I modify my template above? Thank you in advance!
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
