引用GroupName中的CloudFormation

Question

在具有资源的CFT中，引用变量组名称的IAM策略中的"GroupNamed“

 GroupNamed:
  Type: "AWS::IAM::Group"
  Properties:
  GroupName: xyz

 ...

 Effect: Allow
 Action: iam:AddUserToGroup
 Resource: !Sub arn:aws:iam::${AWS::AccountId}:group/GroupNamed

如何参数化组名？

以下是我的尝试，但抛出错误的政策。

1.

Resource: !Join ["", ['arn:aws:iam::',!Sub ${AWS::AccountId}, ':group/',!Ref GroupNamed]]

2.

Resource: !Join ["", ['arn:aws:iam::', !Ref AWS::AccountId, ':group/', !Ref GroupNamed]]

3.

Resource:
             Fn::Join:
             - ''
             - - 'arn:aws:iam::'
               - Fn::Sub: "${AWS::AccountId}"
               - ":group/"
               - Fn::Ref: GroupNamed

错误:模板验证错误:遇到不支持的函数:Fn:Base64 64，Fn::GetAtt，Fn:GetAZs，Fn::ImportValue，Fn:Join，Fn:Split，Fn:FindInMap，Fn:Select，Ref，Fn:Equals，Fn:If，Fn::Not，条件:Fn:Or，Fn::Contains，Fn::EachMemberEquals，Fn:EachMember，Fn::EachMemberIn，Fn:ValueOfAll，：Fn::Cidr

Answer 1

AWS：：IAM：：组文档说，ARN是通过GetAtt提供的。

例如，这将输出该组的ARN：

---
AWSTemplateFormatVersion: 2010-09-09
Description: CloudFormation template for creating lab resources.

Resources:

  GroupNamed:
    Type: "AWS::IAM::Group"
    Properties:
      GroupName: xyz

Outputs:
  GroupARN:
    Value: !GetAtt GroupNamed.Arn

输出是：arn:aws:iam::123456789012:group/xyz

因此，您可以只使用：

Resource: !GetAtt GroupNamed.Arn

Answer 2

假设您要向您的堆栈传递一个名为GroupName的参数。

资源：！subarn:aws:iam：：${AWS：：AccountId}：group/${GroupName}