CloudFortification无法为apigateway创建资源策略 [英] Cloudformation unable to create resource policy for apigateway

问题描述

当我将资源策略直接传递到控制台时，它工作正常。 以下是资源策略示例：-

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "execute-api:Invoke",
            "Resource": "arn:aws:execute-api:us-west-2:339159142535:ooxmwl6q4e/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        ""14.98.8.190/32""
                    ]
                }
            }
        }
    ]
}

现在如何创建一个CloudFortification模板以创建此模板并将其附加到apigateway

我尝试创建策略，但根据新策略，"主体"已删除。

我也创建了一个角色，但没有帮助。以下是角色片段：-

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "Apifirewall": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "apigateway.amazonaws.com"
                                ]
                            },
                            "Action": [
                                "sts:AssumeRole"
                            ]
                        }
                    ]
                },
                "Policies": [
                    {
                        "PolicyName": "Apifirewall",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": "*",
                                    "Resource": [
                                        "arn:aws:execute-api:us-west-2:339159142535:ooxmwl6q4e/*"
                                    ],
                                    "Condition": {
                                        "IpAddress": {
                                            "aws:SourceIp": [
                                                "14.98.8.190/32"
                                            ]
                                        }
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    },
    "Outputs": {
        "Apifirewall": {
            "Value": {
                "Fn::GetAtt": [
                    "Apifirewall",
                    "Arn"
                ]
            }
        }
    }
}

推荐答案

APG网关资源策略未绑定到IAM策略，它是不同种类的资源。

因此，若要在RestApi上实现它，您应该在AWS::ApiGateway::RestApi资源

上使用策略参数

{
  "Type" : "AWS::ApiGateway::RestApi",
  "Properties" : {  
    "ApiKeySourceType" : String,
    "BinaryMediaTypes" : [ String, ... ],
    "Body" : JSON object,
    "BodyS3Location" : S3Location,
    "CloneFrom" : String,
    "Description" : String,      
    "EndpointConfiguration" : EndpointConfiguration,
    "FailOnWarnings" : Boolean,
    "MinimumCompressionSize" : Integer,
    "Name" : String,
    "Parameters" : { String:String, ... },
    "Policy" : JSON object
  }
}

这篇关于CloudFortification无法为apigateway创建资源策略的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！