AWS CloudFormation资源能否对自身调用!GetAtt解决S3清单配置循环依赖

报错原因 #

!GetAtt S3Bucket.Arn 是S3桶资源创建完成后才能返回的运行时属性，将其放在S3桶自身的Properties配置中时，CloudFormation会判定为循环依赖：创建桶需要先获取该ARN值，而获取ARN值又需要桶完成创建。

解决方案 #

手动拼接桶ARN即可规避循环依赖，S3桶的ARN格式固定，可通过!Sub和!Ref组合在模板编译阶段直接生成ARN，无需调用!GetAtt：

S3Bucket:
  Type: AWS::S3::Bucket
  Properties:
    # ...other properties...
    InventoryConfigurations:
    - Id: runs
      Enabled: true
      Destination:
        BucketAccountId: !Ref AWS::AccountId
        # 替换原!GetAtt行，手动拼接ARN
        BucketArn: !Sub arn:${AWS::Partition}:s3:::${S3Bucket}
        Format: CSV
        Prefix: inventory/runs/
      IncludedObjectVersions: Current
      OptionalFields: [ETag, Size, BucketKeyStatus]
      Prefix: runs/
      ScheduleFrequency: Daily

额外注意事项 #

你需要额外配置桶策略，授权S3清单服务写入清单文件的权限，否则清单会生成失败，参考配置如下：

S3BucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref S3Bucket
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Sid: AllowS3InventoryWrite
          Effect: Allow
          Principal:
            Service: s3.amazonaws.com
          Action: s3:PutObject
          Resource: !Sub arn:${AWS::Partition}:s3:::${S3Bucket}/inventory/runs/*
          Condition:
            StringEquals:
              s3:x-amz-acl: bucket-owner-full-control

内容的提问来源于stack exchange，提问作者Rabadash8820