aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Add support for using substitution in StringEquals condition operations for keys and values

Open
#1,090 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::IAM::Policy

### Resource name

_No response_

### Description

Would be nice to use `Fn:Sub` across keys and values in a `StringEquals` condition operation to allow for more dynamic capabilities.

**Example:**
```json
"Condition": {
"Fn::Sub": {
"StringEquals": {
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderId}:aud": "sts.amazonaws.com",
"oidc.eks.${AWS::Region}.amazonaws.com/id/${OIDCProviderId}:sub": "system:serviceaccount:${SSANameSpace}:${SSAName}"
}
}
}
```
Currently, the above example does not work and throws the following error:

```bash
"Message": "An error occurred (ValidationError) when calling the UpdateStack operation: Template error: One or more Fn::Sub intrinsic functions don't specify expected arguments. Specify a string as first argume} "TimeStamp": "2022-02-22T21:49:25.549534Z"lmx4u",ing of values to replace in the string”,
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the reported AWS::IAM::Policy example and the interaction between Fn::Sub and StringEquals condition keys and values. Define the supported substitution behavior and verify that the supplied template can be processed during a stack update without the reported validation error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.