aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Requesting AWS::EFS::FileSystem to support a String type for FileSystemPolicy property

Open
#1,805 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EFS::FileSystem

### Resource name

AWS::EFS::FileSystem

### Description

### Use case

I would like to provide the following file system policy through a CloudFormation String parameter `FSPolicy`:

**Policy**
```
{ "Id": "read-only-example-policy02", "Statement": [ { "Sid": "efs-statement-example02", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": ["elasticfilesystem:ClientMount"], "Resource": "*" } ] }
```

**CFN template**
```
Parameters:
FSPolicy:
Description: The IAM's FileSystemPolicy for the EFS
Type: String

Resources:
EFS:
Type: AWS::EFS::FileSystem
Properties:
Encrypted: true
FileSystemPolicy: !Ref FSPolicy
```

However, this fails with

```
Resource handler returned message: "Model validation failed (#/Encrypted: expected type: Boolean, found: String #/FileSystemPolicy: expected type: JSONObject, found: String)" (RequestToken: abc123, HandlerErrorCode: InvalidRequest)
```

This property accepts a `Json` type, similar to `AWS::S3::BucketPolicy` [PolicyDocument property](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-policy.html#aws-properties-s3-policy-policydocument). I can pass the bucket policy through a parameter with no issues.

### Schema

Looking at the [resource type schema for EFS FS](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-type-schemas.html), I see that it accepts `object` value type.

```
"FileSystemPolicy" : {
"type" : "object"
},
```

On the other hand, `PolicyDocument` of bucket policy resource accepts both `object` and `string` value type.
```
"PolicyDocument" : {
"description" : "A policy document containing permissions to add to the specified bucket. In IAM, you must provide policy documents in JSON format. However, in CloudFormation you can provide the policy in JSON or YAML format because CloudFormation converts YAML to JSON before submitting it to IAM.",
"type" : [ "object", "string" ]
}
```

### Request

From the investigation above, I believe this use case can be fulfilled if `FileSystemPolicy` accepts both `object` and `string`. Please let us know otherwise.

Hence, I would like to request for AWS::EFS::FileSystem resource to support String value for [FileSystemPolicy property](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-efs-filesystem.html#cfn-efs-filesystem-filesystempolicy).

Thank you!

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::EFS::FileSystem resource schema and the AWS::S3::BucketPolicy PolicyDocument schema linked in the issue. Compare how each property is typed and confirm whether the requested schema update is supported; done means FileSystemPolicy accepts both object and string values without the reported validation error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.