AWS CloudFormation模板中按环境为IAM角色附加策略报错求助

错误原因 #

你定义的devandqa条件不符合Fn::Or的语法要求：!Or的每个参数必须是布尔类型的条件判断，但你第二个参数直接写了[!Ref Environment, qa]，这不是一个完整的布尔表达式，导致触发报错：Template error: every Fn::Or object requires a list of at least 2 and at most 10 boolean parameters。

修正方案 #

有两种简单的修正方式，任选其一即可：

方案1：复用已定义的dev/qa条件

直接引用之前已经定义好的dev和qa布尔条件，简化devandqa的写法：

Conditions:
  dev: !Equals [!Ref Environment, dev]
  qa: !Equals [!Ref Environment, qa]
  prd: !Equals [!Ref Environment, prod]
  # 修正后的devandqa条件
  devandqa: !Or [!Condition dev, !Condition qa]

方案2：补全完整的布尔判断

如果不想复用已有条件，直接在!Or中写两个完整的!Equals判断：

Conditions:
  dev: !Equals [!Ref Environment, dev]
  qa: !Equals [!Ref Environment, qa]
  prd: !Equals [!Ref Environment, prod]
  # 修正后的devandqa条件
  devandqa: !Or 
    - !Equals [!Ref Environment, dev]
    - !Equals [!Ref Environment, qa]

完整修正后的模板 #

AWSTemplateFormatVersion: '2010-09-09'
Description: AWS CloudFormation template

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - qa
      - prod
    Description: 输入dev、qa或prod，默认值为dev

Conditions:
  dev: !Equals [!Ref Environment, dev]
  qa: !Equals [!Ref Environment, qa]
  prd: !Equals [!Ref Environment, prod]
  devandqa: !Or [!Condition dev, !Condition qa]

Resources:
  ManagedInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - ec2.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::111111111111:policy/service-role/AWSGlueServiceRole-test-glue-crawler-role
      - !If
        - devandqa
        - arn:aws:iam::111111111111:policy/attach-s3-policy
        - !Ref AWS::NoValue

内容的提问来源于stack exchange，提问作者Villa