CloudFormation IAM资源循环依赖：如何在角色内联策略中引用自身ARN

你当前将包含自身ARN引用的内联策略直接写在IAM角色的Policies属性内，CloudFormation创建IAM角色时需要先完成所有属性的预校验与生成，但内联策略中的!GetAtt SSMHostMgmtRole.Arn需要等待角色创建完成后才能返回有效值，二者互相等待形成循环依赖。

提供两种经过验证的修改方式，任选其一即可解决问题：

方案1：拆分内联策略为独立资源（通用推荐） #

将策略从IAM角色属性中剥离，创建独立的AWS::IAM::RolePolicy资源，该资源会自动依赖角色先创建完成再附加，此时角色ARN已经可以正常获取。
修改后完整模板如下：

Resources:
  SSMHostMgmtRole:
     Type: AWS::IAM::Role
     Properties:
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ssm.amazonaws.com
         Version: '2012-10-17'
       Path: "/"
       RoleName: !Sub ${AWS::StackName}-${AWS::Region}-HostMgmtRole

  # 独立的角色策略资源
  SSMHostMgmtRolePolicy:
    Type: AWS::IAM::RolePolicy
    Properties:
      PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-Example
      Role: !Ref SSMHostMgmtRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Action:
          - iam:PassRole
          Effect: Allow
          Resource: !GetAtt SSMHostMgmtRole.Arn

方案2：直接拼接ARN避免运行时获取 #

你的角色名是通过模板参数固定生成的，不需要通过!GetAtt运行时获取ARN，直接在模板渲染阶段拼接出角色ARN即可消除依赖：

Resources:
  SSMHostMgmtRole:
     Type: AWS::IAM::Role
     Properties:
       AssumeRolePolicyDocument:
         Statement:
         - Action:
           - sts:AssumeRole
           Effect: Allow
           Principal:
             Service:
             - ssm.amazonaws.com
         Version: '2012-10-17'
       Path: "/"
       Policies:
       - PolicyDocument:
           Version: '2012-10-17'
           Statement:
           - Action:
             - iam:PassRole
             Effect: Allow
             # 直接拼接ARN，无需!GetAtt调用
             Resource: !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${AWS::StackName}-${AWS::Region}-HostMgmtRole
         PolicyName: !Sub ${AWS::StackName}-${AWS::Region}-Example
       RoleName: !Sub ${AWS::StackName}-${AWS::Region}-HostMgmtRole

内容的提问来源于stack exchange，提问作者Leroy Luff