aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Add support for using substitution in StringEquals condition operations for keys and values
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::IAM::Policy
### Resource name
_No response_
### Description
Would be nice to use `Fn:Sub` across keys and values in a `StringEquals` condition operation to allow for more dynamic capabilities.
**Example:**
```json
"Condition": {
"Fn::Sub": {
"StringEquals": {
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderId}:aud": "sts.amazonaws.com",
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderId}:sub": "system:serviceaccount:${SSANameSpace}:${SSAName}"
}
}
}
```
Currently, the above example does not work and throws the following error:
```bash
"Message": "An error occurred (ValidationError) when calling the UpdateStack operation: Template error: One or more Fn::Sub intrinsic functions don't specify expected arguments. Specify a string as first argume} "TimeStamp": "2022-02-22T21:49:25.549534Z"lmx4u",ing of values to replace in the string”,
```
### Other Details
_No response_
Contributor guide
Research direction
Start with the reported AWS::IAM::Policy example and the interaction between Fn::Sub and StringEquals condition keys and values. Define the supported substitution behavior and verify that the supplied template can be processed during a stack update without the reported validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100