如何使用cloudformation生成AWS字符串条件

Question

我有下面的代码，但是不能用StringEquals获得end部分来打印正确的值，运行cloudformation。

Parameters:
  OpenIDClientIdList:
    Type: String
    Description: Open ID client ID 
    Default: urn:dev.aws.services.xxxxx.com

  OpenIDURL:
    Type: String
    Description: Open ID URL
    Default: "sts.windows.net/dddddd-rr444-ssss-94c3-7484898492d/"

Resources:
  OpenIDCAssumeReadOnlyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: OpenIDCAssumeReadOnlyRole
      ManagedPolicyArns: [arn:aws:iam::aws:policy/ReadOnlyAccess]
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Federated: !Sub arn:aws:iam::${AWS::AccountId}:oidc-provider/${OpenIDURL}
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals: !Sub
              - ''
              - - '${OpenIDURL}:aud:'
                - '${OpenIDClientIdList}'

期望条件字符串值

         "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringEquals": {
                    "sts.windows.net/dddddd-rr444-ssss-94c3-7484898492d/:aud": "urn:dev.aws.services.xxxxx.com"
                }
            }

Answer 1

您没有正确地使用!Sub。情况应该是这样的：

Condition:
  StringEquals: 
    Fn::Base64: !Sub
    - |
      "${OPENIDURL}:aud": "${OPENIDCLIENTIDLIST}"
    - OPENIDURL: !Ref OpenIDURL
      OPENIDCLIENTIDLIST: !Ref OpenIDClientIdList