如何在CloudFormation中基于逗号分隔列表生成动态ARN

我在CloudFormation里定义了如下参数：

Parameters:
  Names:
    Default: "name1,name2,name3"
    Type: CommaDelimitedList

需要基于这个列表生成对应的IAM资源ARN，期望输出格式如下：

Resources:
  - "arn:aws:iam::111111111111:lambda/name1"
  - "arn:aws:iam::111111111111:lambda/name2"
  - "arn:aws:iam::111111111111:lambda/name3"

解决方案 #

方法1：使用Fn::ForEach（推荐，需模板版本2021-09-09+） #

借助CloudFormation的Fn::ForEach遍历参数列表，结合Fn::Sub生成每个ARN，代码可读性强：

AWSTemplateFormatVersion: 2021-09-09
Parameters:
  Names:
    Default: "name1,name2,name3"
    Type: CommaDelimitedList
  AccountId:
    Default: "111111111111"
    Type: String

Resources:
  # 示例：将生成的ARN列表用于IAM托管策略
  LambdaInvokePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: lambda:InvokeFunction
            Resource:
              !ForEach Name in !Ref Names:
                - !Sub "arn:aws:iam::${AccountId}:lambda/${Name}"

方法2：兼容旧版本模板（无Fn::ForEach支持） #

如果你的CloudFormation模板版本低于2021-09-09，可以通过Fn::Split和Fn::Join组合实现：

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  Names:
    Default: "name1,name2,name3"
    Type: CommaDelimitedList
  AccountId:
    Default: "111111111111"
    Type: String

Resources:
  LambdaInvokePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Action: lambda:InvokeFunction
            Resource: !Split
              - ","
              - !Sub "arn:aws:iam::${AccountId}:lambda/${!Join(',arn:aws:iam::${AccountId}:lambda/', !Ref Names)}"

内容的提问来源于stack exchange，提问作者Karen Kostanyan