aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Requesting AWS::EFS::FileSystem to support a String type for FileSystemPolicy property
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EFS::FileSystem
### Resource name
AWS::EFS::FileSystem
### Description
### Use case
I would like to provide the following file system policy through a CloudFormation String parameter `FSPolicy`:
**Policy**
```
{ "Id": "read-only-example-policy02", "Statement": [ { "Sid": "efs-statement-example02", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": ["elasticfilesystem:ClientMount"], "Resource": "*" } ] }
```
**CFN template**
```
Parameters:
FSPolicy:
Description: The IAM's FileSystemPolicy for the EFS
Type: String
Resources:
EFS:
Type: AWS::EFS::FileSystem
Properties:
Encrypted: true
FileSystemPolicy: !Ref FSPolicy
```
However, this fails with
```
Resource handler returned message: "Model validation failed (#/Encrypted: expected type: Boolean, found: String #/FileSystemPolicy: expected type: JSONObject, found: String)" (RequestToken: abc123, HandlerErrorCode: InvalidRequest)
```
This property accepts a `Json` type, similar to `AWS::S3::BucketPolicy` [PolicyDocument property](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html#aws-properties-s3-policy-policydocument). I can pass the bucket policy through a parameter with no issues.
### Schema
Looking at the [resource type schema for EFS FS](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-type-schemas.html), I see that it accepts `object` value type.
```
"FileSystemPolicy" : {
"type" : "object"
},
```
On the other hand, `PolicyDocument` of bucket policy resource accepts both `object` and `string` value type.
```
"PolicyDocument" : {
"description" : "A policy document containing permissions to add to the specified bucket. In IAM, you must provide policy documents in JSON format. However, in CloudFormation you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to IAM.",
"type" : [ "object", "string" ]
}
```
### Request
From the investigation above, I believe this use case can be fulfilled if `FileSystemPolicy` accepts both `object` and `string`. Please let us know otherwise.
Hence, I would like to request for AWS::EFS::FileSystem resource to support String value for [FileSystemPolicy property](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-filesystem.html#cfn-efs-filesystem-filesystempolicy).
Thank you!
### Other Details
_No response_
Contributor guide
Research direction
Start with the AWS::EFS::FileSystem resource schema and the AWS::S3::BucketPolicy PolicyDocument schema linked in the issue. Compare how each property is typed and confirm whether the requested schema update is supported; done means FileSystemPolicy accepts both object and string values without the reported validation error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100