In AWS Cloud formation, How to specify two resources with Ref in IAM Policy?

user_484919 0
Viewed 460

How to combine two same IAM Policies in one if they are target two different resources. One of the resource has Join and Ref. Can below two Policies be merged to single in CloudFormation Template?

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource:
    !Join
      - ''
      - - 'arn:aws:s3:::'
        - !Ref TestBucketName
        - '/*'

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource: "arn:aws:s3:::SecondTestBucket/Download/*"
amazon-cloudformation amazon-iam amazon-web-services amazon-s3 yaml
2 Answers

You can also use !Sub or Fn::Sub instead of Join as below for the clear code.

- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectAcl"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource:
    - !Sub arn:aws:s3:::${TestBucketName}/*
    - "arn:aws:s3:::SecondTestBucket/Download/*"
user_11716450 
- Effect: Allow
  Action:
    - "s3:DeleteObject"
    - "s3:DeleteObjectAcl"
    - "s3:DeleteObjectTagging"
    - "s3:GetObjectAcl"
    - "s3:GetObjectTagging"
    - "s3:PutObject"
    - "s3:PutObjectAcl"
    - "s3:PutObjectTagging"
  Resource:
    - !Join
      - ''
      - - 'arn:aws:s3:::'
        - !Ref TestBucketName
        - '/*'
    - "arn:aws:s3:::SecondTestBucket/Download/*"
user_4849190
Related