how to add a condition when writing a aws policy via cloudformation?

user_13645093 0
Viewed 472

I am creating some IAM roles, policies via cloudformation but I would like to add policies based on the condition I have, say if it is dev then i would like to add certain policy statement. any suggestions ?

Parameters:
    environment:
        Type: String
        Default: dev
        AllowedValues:
            - dev
            - prd
Condition:
    isDev: !Equals [ !Ref environment, dev]

Resources:
  StandAlonePolicy:
    Type: AWS::IAM::Policy
    Properties:
      #How to add a condition - isDev
      PolicyName: "s3-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Resource: "*"
          Action:
            - "s3:Get*"
amazon-cloudformation amazon-iam amazon-web-services
1 Answers

You can do this using If:

Parameters:
    environment:
        Type: String
        Default: dev
        AllowedValues:
            - dev
            - prd
Conditions:
    isDev: !Equals [ !Ref environment, dev]

Resources:
  StandAlonePolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: "s3-policy"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: Allow
          Resource: "*"
          Action:
            - "s3:Get*"
        - !If    
            - isDev
            - Sid: new-statement-for-dev-only
              Effect: Allow
              Resource: "*"
              Action:
                - "s3:Put*"
            - !Ref "AWS::NoValue"
user_2488230
Related