CloudFormation YAML格式错误排查及多ARN条件配置方案咨询

在已部署的CloudFormation栈模板中添加AWS::SecretsManager::ResourcePolicy资源策略后，执行时出现错误：

"YAML not well-formed. (line 249, column 21)"

标记的第249行及后续是用!Sub生成的多个IAM角色ARN，仅保留前4个ARN时错误消失，但业务需要配置超过4个ARN。查阅AWS官方文档未找到条件键的条目数量限制，现寻求可行的替代解决方案。

相关代码片段：

ATMDatabaseSecretResourcePolicy:
    Type: 'AWS::SecretsManager::ResourcePolicy'
    Properties:
      BlockPublicPolicy: true
      SecretId: !Ref ATMDatabase
      ResourcePolicy:
        Version: '2012-10-17'
        Statement:
          - Action: secretsmanager:GetSecretValue
            Effect: Deny
            Principal: '*'
            Resource: '*'
            Condition:
              'StringNotEquals':
                'aws:principalArn': 
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Deploy'
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-DEVAdmin'
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Support'
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Developer'
                  - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanMiddlewareRole'        --  line 249
                  - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanAccountRole'
                  - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthorizerRole'
                  - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthenticationRole'
                'aws:sourceVpce':
                  Fn::ImportValue:
                    !Sub '${TargetNetworkStack}-AppsVpcId'

可行替代方案 #

方案1：拆分Condition为多条件组合 #

将单个StringNotEquals下的ARN列表拆分为多个条件，用And逻辑组合，避免单列表条目过多触发YAML解析异常：

Condition:
  'And':
    - 'StringNotEquals':
        'aws:principalArn':
          - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Deploy'
          - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-DEVAdmin'
          - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Support'
          - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Developer'
    - 'StringNotEquals':
        'aws:principalArn':
          - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanMiddlewareRole'
          - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanAccountRole'
          - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthorizerRole'
          - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthenticationRole'
    - 'StringNotEquals':
        'aws:sourceVpce':
          Fn::ImportValue:
            !Sub '${TargetNetworkStack}-AppsVpcId'

方案2：用!Join+!Split拼接ARN列表 #

将所有ARN通过!Join拼接成字符串，再用!Split转换为列表，减少YAML层级的解析压力：

'aws:principalArn': !Split 
  - ','
  - !Join 
    - ','
    - - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Deploy'
      - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-DEVAdmin'
      - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Support'
      - !Sub 'arn:aws:iam::${AWS::AccountId}:role/DA-Developer'
      - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanMiddlewareRole'
      - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanAccountRole'
      - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthorizerRole'
      - !sub 'arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthenticationRole'

方案3：提前定义ARN列表参数/映射 #

在模板顶部用Parameters或Mappings统一存储ARN列表，再在Condition中引用，让结构更清晰，同时避免解析问题：

# 模板顶部定义参数
Parameters:
  AllAllowedRoles:
    Type: CommaDelimitedList
    Default: >-
      arn:aws:iam::${AWS::AccountId}:role/DA-Deploy,
      arn:aws:iam::${AWS::AccountId}:role/DA-DEVAdmin,
      arn:aws:iam::${AWS::AccountId}:role/DA-Support,
      arn:aws:iam::${AWS::AccountId}:role/DA-Developer,
      arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanMiddlewareRole,
      arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-LoanAccountRole,
      arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthorizerRole,
      arn:aws:iam::${AWS::AccountId}:role/${InstanceIdentifier}-AuthenticationRole

# 然后在ResourcePolicy中引用
'aws:principalArn': !Ref AllAllowedRoles

内容的提问来源于stack exchange，提问作者user10342013