问题描述
我正在尝试使用 CloudFormation 创建 IAM 角色。以下代码段显示了信任策略:
{
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Principal": {
"Federated": "arn:aws:iam::1234567890123:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/89ABCDWEFGHRRUUUR4DDF70C"
},"Action": "sts:AssumeRoleWithWebIdentity","Condition": {
"StringEquals": {
"oidc.eks.us-east-1.amazonaws.com/id/89ABCDWEFGHRRUUUR4DDF70C:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller"
}
}
}
]
}
我想让它动态化,因为它应该从映射或参数中选择 OIDC 提供程序的值。
这是我目前所做的:
"AssumeRolePolicyDocument": {
"Version": "2012-10-17","Statement": [
{
"Effect": "Allow","Principal": {
"Federated": {
"Fn::Join": [
"",[
{
"Fn::Sub": "arn:aws:iam::${AWS::AccountId}:oidc-provider/"
},{
"Fn::FindInMap": [
"Environments",{
"Ref": "EnvironUsed"
},"OIDCProvider"
]
}
]
]
}
},"Condition": {
"StringEquals": {
"oidc.eks.us-east-1.amazonaws.com/id/89738A59036B9EB2704B9ABC44DDF70C:sub" : "system:serviceaccount:kube-system:aws-load-balancer-controller"
}
}
}
]
}
我无法使最后一部分(提到 OIDC 提供商的条件部分)动态化。当我尝试在花括号中包含 Fn::Join 代替 "oidc.eks.us-east-1.amazonaws.com/id/89ABCDWEFGHRRUUUR4DDF70C:sub"
时,JSON 无效>解决方法
暂无找到可以解决该程序问题的有效方法,小编努力寻找整理中!
如果你已经找到好的解决方法,欢迎将解决方案带上本链接一起发送给小编。
小编邮箱:dio#foxmail.com (将#修改为@)