CloudFormation创建带AssumeRole权限的IAM用户时出现语法错误求助

问题描述 #

需创建具备AssumeRole权限的IAM用户，uat环境切换至账号123451234512的角色，stg环境切换至账号123451234513的角色，根据环境参数匹配对应AccountId。部署CloudFormation模板时触发IAM策略语法错误：

Resource handler returned message: "Syntax errors in policy. (Service: Iam, Status Code: 400, Request ID: 8c2edcc6-0050-424a-8d3f-585102asd1t)" (RequestToken: 45930d92-bb77-c55a-c02a-06529728afs, HandlerErrorCode: InvalidRequest)

错误原因 #

问题出在Policy02的Resource字段：!Sub函数内部嵌套FindInMap时多写了一个!符号。正确写法是在!Sub的变量引用中直接使用FindInMap函数，无需额外添加!。

错误代码片段：

Resource: !Sub arn:aws:iam::${!FindInMap [AccountMap, !Ref NetworkEnvironment, AccountId]}:role/testbucket1209

修正后的完整代码 #

AWSTemplateFormatVersion: '2010-09-09'
Description: Create test User
Parameters:
  NetworkEnvironment:
    Description: test
    Type: String
    Default: uat
    AllowedValues:
      - uat
      - stg
      - prd

Mappings:
  AccountMap:
    uat:
      AccountId: "123451234512"
    stg:
      AccountId: "123451234513"
    prd:
      AccountId: "123451234514"

Resources:
  User01:
    Type: AWS::IAM::User
    DeletionPolicy: Retain
    Properties:
      Path: /
      UserName: !Sub ${NetworkEnvironment}-test-user
      Tags:
        - Key: Name
          Value: !Sub ${NetworkEnvironment}-asd
        - Key: Environment
          Value: !Sub ${NetworkEnvironment}

  Policy01:
    Type: AWS::IAM::Policy
    DeletionPolicy: Retain
    Properties:
      PolicyName: !Sub ${NetworkEnvironment}-test-policy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - logs:PutLogEvents
              - logs:GetLogEvents
            Resource: '*'
      Users:
        - !Ref User01

  Policy02:
    Type: AWS::IAM::Policy
    DeletionPolicy: Retain
    Properties:
      PolicyName: !Sub ${NetworkEnvironment}-test-assume-role
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Resource: !Sub arn:aws:iam::${FindInMap [AccountMap, !Ref NetworkEnvironment, AccountId]}:role/testbucket1209
      Users:
        - !Ref User01

验证说明 #

修正后，!Sub会正确解析FindInMap的返回值，生成格式合法的IAM角色ARN。部署时CloudFormation会根据NetworkEnvironment参数，从AccountMap映射中匹配对应账号ID并替换到ARN中，避免语法错误。

内容的提问来源于stack exchange，提问作者B A