使用CloudFormation创建S3 Bucket时出现Error 400 (Bad Request)问题

我在参与Amazon Chime SDK workshop时，使用官方CloudFormation模板创建S3 Bucket遇到Error 400 (Bad Request)错误。

执行的CLI命令：

aws cloudformation create-stack --stack-name chimesdk-ws-102-s3-cfd --template-body file://csdk-ws-102-s3-cfd.yml

CloudFormation模板内容：

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFront distribution with an S3 origin for Amazon ChimeSDK WS-102'

Resources:
  S3Bucket:
    DeletionPolicy: 'Delete'
    Metadata:
      Comment: 'Bucket to store some data for chimesdk-workshops'
    Properties:
      AccessControl: 'Private'
      BucketName: !Sub 's3-origin-chimesdk-workshops-${AWS::StackName}-${AWS::AccountId}-${!RandomDigits 3}'
    Type: 'AWS::S3::Bucket'

  S3BucketPolicy:
    Metadata:
      Comment: 'Bucket policy to allow CloudFront to access S3'
    Properties:
      Bucket: !Ref S3Bucket
      PolicyDocument:
        Statement:
          - Action:
              - 's3:GetObject'
            Effect: 'Allow'
            Principal:
              CanonicalUser: !GetAtt CfOriginAccessIdentity.S3CanonicalUserId
            Resource:
              - !Sub 'arn:aws:s3:::${S3Bucket}/*'
    Type: 'AWS::S3::BucketPolicy'

  CfDistribution:
    Metadata:
      Comment: 'CloudFront distribution with an S3 origin for Amazon ChimeSDK WS-102'
    Properties:
      DistributionConfig:
        Comment: 'CloudFront distribution with an S3 origin for Amazon ChimeSDK WS-102'
        DefaultCacheBehavior:
          AllowedMethods:
            - 'HEAD'
            - 'GET'
          CachedMethods:
            - 'HEAD'
            - 'GET'
          Compress: false
          DefaultTTL: 86400
          ForwardedValues:
            Cookies:
              Forward: 'none'
            Headers:
              - 'Origin'
            QueryString: false
          MaxTTL: 31536000
          MinTTL: 86400
          TargetOriginId: !Sub 's3-origin-${S3Bucket}'
          ViewerProtocolPolicy: 'redirect-to-https'
        DefaultRootObject: 'index.html'
        Enabled: true
        HttpVersion: 'http1.1'
        IPV6Enabled: false
        Origins:
          - DomainName: !GetAtt S3Bucket.DomainName
            Id: !Sub 's3-origin-${S3Bucket}'
            OriginPath: ''
            S3OriginConfig:
              OriginAccessIdentity: !Sub 'origin-access-identity/cloudfront/${CfOriginAccessIdentity}'
        PriceClass: 'PriceClass_All'
    Type: 'AWS::CloudFront::Distribution'

  CfOriginAccessIdentity:
    Metadata:
      Comment: 'Access S3 bucket content only through CloudFront'
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: 'Access S3 bucket content only through CloudFront'
    Type: 'AWS::CloudFront::CloudFrontOriginAccessIdentity'

Outputs:
  S3BucketName:
    Description: 'Bucket name'
    Value: !Ref S3Bucket
  CfDistributionId:
    Description: 'Id for CloudFront distribution with an S3 origin for Amazon ChimeSDK WS-102'
    Value: !Ref CfDistribution
  CfDistributionDomainName:
    Description: 'Domain name for CloudFront distribution with an S3 origin for Amazon ChimeSDK WS-102'
    Value: !GetAtt CfDistribution.DomainName

错误信息：

Bad Request (Service: Amazon S3; Status Code: 400; Error Code: 400 Bad Request; Request ID: HYNPE7QQSABRN1ZV; S3 Extended Request ID: kmLUHBpmYN1ZQ9OJ928MgY+ZsbrzLmKm74v2m3K0NbPiF/dKWgA6rrDP9criO/rdUQAVKHoY1F0=; Proxy: null)

问题出在S3 Bucket名称的定义语法上：

BucketName: !Sub 's3-origin-chimesdk-workshops-${AWS::StackName}-${AWS::AccountId}-${!RandomDigits 3}'

在!Sub函数中调用RandomDigits时额外多了一个!，正确的写法应该是${RandomDigits 3}，多余的!导致生成的Bucket名称不符合S3命名规范，触发400错误。

修改S3 Bucket资源的BucketName字段，去掉多余的!：

S3Bucket:
  DeletionPolicy: 'Delete'
  Metadata:
    Comment: 'Bucket to store some data for chimesdk-workshops'
  Properties:
    AccessControl: 'Private'
    BucketName: !Sub 's3-origin-chimesdk-workshops-${AWS::StackName}-${AWS::AccountId}-${RandomDigits 3}'
  Type: 'AWS::S3::Bucket'

修改完成后重新执行CloudFormation创建命令即可。

内容的提问来源于stack exchange，提问作者Hassan Ansari