aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

ForEach not able to create IAM Role policy

Open
#1,864 0 comments 8 reactions 0 assignees View on GitHub
other
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Resource Name

'AWS::IAM::RolePolicy'

### Details

I am trying to create one RolePolicy with multiple resources to be allowed (accepted as parameters from users as CommaDelimitedList.

It transforms not correct, and while creation of Policy it fails :(

I want my permission to be like:

`{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1702056876959",
"Action": "s3:*",
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::bucket1",
"arn:aws:s3:::bucket2"
}
]
}`

`---
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::LanguageExtensions

Parameters:
BucketList:
Description: List of S3 buckets
Type: CommaDelimitedList

Resources:
VolumeRolePolicy:
Type: 'AWS::IAM::RolePolicy'
Properties:
PolicyName: volume-policy
PolicyDocument:
Statement:
- Sid: BucketIAMPolicy
Action:
- '*'
Effect: Allow
'Fn::ForEach::Policy':
- Bucket
- !Ref BucketList
- Resource:
- !Sub arn:aws:s3:::${Bucket}/*
RoleName: 'TestIamRole'`

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files, tests, or implementation entry point. Start by reproducing the supplied AWS::LanguageExtensions template with a CommaDelimitedList and compare the generated IAM RolePolicy document with the expected Resource array; done means multiple bucket ARNs are accepted during policy creation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.