AWS CloudFormation中Fn::GetAtt模板错误排查求助

你遇到的错误提示Template error: every Fn::GetAtt object requires two non-empty parameters, the resource name and the resource attribute，根源是模板存在多处缩进和结构错误，导致CloudFormation无法正确解析资源及属性，以下是具体问题和修复方案：

问题点梳理 #

• 资源定义缩进错误：MyS3BucketName资源的Type和Properties未正确缩进，导致该资源定义不完整，后续!GetAtt无法识别有效资源
• Outputs字段缩进错误：WebsiteURL的Value字段未缩进，不符合YAML格式规范
• BucketPolicy结构错误：第一个Statement的Action和Resource未缩进，脱离了所属的Statement块，破坏了PolicyDocument的结构
• 网站URL属性错误：生成网站URL应该使用S3资源的WebsiteURL属性，而非Arn

修复后的完整模板 #

Resources:
  MyS3BucketName:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
      BucketName:
        !Sub
        - '${TheEnv}-sample-s3-ui-${TheBucketRegion}'
        - TheEnv: !Ref EnvName
          TheBucketRegion: !Ref AWS::Region
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              KMSMasterKeyID: !GetAtt S3BucketKmsKey.Arn
              SSEAlgorithm: aws:kms
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: "expiration-rule"
            Status: Enabled
            ExpirationInDays: !Ref S3BucketFileExpirationInDays
      VersioningConfiguration:
        Status: Suspended

  S3BucketForIncomingFilesBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref MyS3BucketName
      PolicyDocument:
        Statement:
          - Sid: "FullAccessForOps"
            Effect: "Allow"
            Principal:
              AWS:
                - !Sub
                  - "arn:aws:iam::${TheAccountNumber}:role/${TheRoleName}"
                  - TheAccountNumber: !FindInMap [AccountNumbers, ops, core]
                    TheRoleName: "Ops"
                - !Sub
                  - "arn:aws:iam::${TheAccountNumber}:role/${TheRoleName}"
                  - TheAccountNumber: !FindInMap [AccountNumbers, devops, core]
                    TheRoleName: "Developer"
            Action:
              - "s3:*"
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref MyS3BucketName]]
              - !Join ["", ["arn:aws:s3:::", !Ref MyS3BucketName, "/*"]]
          - Sid: "FullAccessToAccountRoot"
            Effect: "Allow"
            Principal:
              AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
            Action:
              - "s3:*"
            Resource:
              - !Join ["", ["arn:aws:s3:::", !Ref MyS3BucketName]]
              - !Join ["", ["arn:aws:s3:::", !Ref MyS3BucketName, "/*"]]

Outputs:
  WebsiteURL:
    Value: !GetAtt MyS3BucketName.WebsiteURL
    Description: URL for website hosted on S3
  S3BucketSecureURL:
    Value: !Join
      - ''
      - - 'https://'
        - !GetAtt MyS3BucketName.DomainName
    Description: Name of S3 bucket to hold website content

关键修复说明 #

1. 修正了MyS3BucketName资源的缩进，确保Type和Properties属于该资源的子属性
2. 调整WebsiteURL的Value字段缩进，符合YAML格式要求
3. 修复BucketPolicy中第一个Statement的Action和Resource缩进，确保它们属于对应的Statement块
4. 将WebsiteURL的!GetAtt MyS3BucketName.Arn改为!GetAtt MyS3BucketName.WebsiteURL，正确获取S3静态网站的访问地址

内容的提问来源于stack exchange，提问作者Ram