CloudFormation中传递变量的正确方式及OIDC参数替换问题

问题出在CloudFormation无法直接解析字典键中的变量插值，且直接对StringEquals字典使用!Sub会因类型不匹配报错。以下是两种可行的解决方法：

方法一：使用!Sub长格式构造键值对 #

通过!Sub的参数映射方式，在字典键中实现变量替换：

ClusterAutoscalerRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: !Sub ${Environment}-cluster-autoscaler
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/${OIDCProviderUrl}"
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals:
              !Sub
                - "${Url}:sub": "system:serviceaccount:kube-system:cluster-autoscaler"
                  "${Url}:aud": "sts.amazonaws.com"
                - Url: !Ref OIDCProviderUrl

方法二：使用!Join拼接键名 #

通过!Join将OIDC地址和后缀拼接成完整的键名：

ClusterAutoscalerRole:
  Type: AWS::IAM::Role
  Properties:
    RoleName: !Sub ${Environment}-cluster-autoscaler
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Federated: !Sub "arn:aws:iam::${AWS::AccountId}:oidc-provider/${OIDCProviderUrl}"
          Action: sts:AssumeRoleWithWebIdentity
          Condition:
            StringEquals:
              !Join ['', [!Ref OIDCProviderUrl, ':sub']]: "system:serviceaccount:kube-system:cluster-autoscaler"
              !Join ['', [!Ref OIDCProviderUrl, ':aud']]: "sts.amazonaws.com"

原因说明 #

• 直接在字典键中写${OIDCProviderUrl}:sub时，CloudFormation会将其视为字面量字符串，不会执行变量替换。
• 对整个StringEquals字典添加!Sub会触发类型错误，因为!Sub只能处理字符串或列表，无法直接解析字典结构，导致"unhashable type: 'dict'"报错。

内容的提问来源于stack exchange，提问作者Baiqing