在 YAML cloudformation 中加入多个资源

Question

下面是我的 Cloudformation 模板，我想添加多个资源低于错误

模板包含错误。：模板格式错误：YAML 格式不正确。 （第 61 行，第 1 列）

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  This template creates IoT policy - attaches to a device certificate, IoT Topic
  Rule- used to forward messages to sns based on service key, and creates
  required IAM roles for these.

Parameters:
  vpcname:
    Type: String
    Description: Enter vpcname
  vpcnamefirstletterupper:
    Type: String
    Description: Enter vpcname with camelcase, ex- "Usdevms"
  taaccountid:
    Type: String
    Description: Enter TA AccountID"
Resources:
  IoTDaasDeviceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Join ["",[IoTDaasDeviceRole.,!Ref vpcname]]
      MaxSessionDuration : 43200
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Join ["",[!Sub 'arn:aws:iam::${AWS::AccountId}:role/Daas',!Ref vpcnamefirstletterupper,'IotCredentialLambda']]
              Service: lambda.amazonaws.com
            Action:
              - 'sts:AssumeRole'              
  IoTDaasDevicePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      Description: >-
        This Policy will be attached to the device role and lists the
        permissions given to device certificates
      ManagedPolicyName: !Join
                      - ''
                      - - 'IoTDaasDeviceConnectPolicy.'
                        - !Ref vpcname
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: 'iot:Connect'
            Resource: !Join 
              - ''
              - - !Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:client/'
                - '*'
          - Effect: Allow
            Action: 'iot:Publish'
            Resource: !Join 
              - ''
              - - !Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/$aws/rules/daas_device_events_rule_'
                - !Ref vpcname
                - '/*'
          - Effect: Allow
            Action: 'iot:StartNextPendingJobExecution'
            Resource: {
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:things/','*']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/$aws/things/thingName/jobs/start-next/']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/accepted']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/rejected']]
                      }
          - Effect: Allow
            Action: 'iot:UpdateJobExecution'
            Resource: !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:things/','*']]
          - Effect: Allow
            Action: 'execute-api:Invoke'
            Resource: !Join ['', [!Sub 'arn:aws:execute-api:${AWS::Region}:',!Ref taaccountid,':hpe5n6k1v8/Test/GET']]  
      Roles:
        - Ref: IoTDaasDeviceRole

Answer 1

以下不正确：

            Resource: {
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:things/','*']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/$aws/things/thingName/jobs/start-next/']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/accepted']],
                      !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/rejected']]                      }

因为它会创建地图，但您需要一个列表：

            Resource: 
              - !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:things/','*']]
              - !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topic/$aws/things/thingName/jobs/start-next/']]
              - !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/accepted']]
              - !Join ["",[!Sub 'arn:aws:iot:${AWS::Region}:${AWS::AccountId}:topicfilter/$aws/things/thingName/jobs/start-next/rejected']]

请注意，您的模板中仍可能存在问题，这些问题尚不明显。

Answer 2

您可以使用aws cloudformation 命令行来验证您的模板，这是在您提供的文件上运行它时的输出：

$ aws cloudformation validate-template --template-body file://test.template

An error occurred (ValidationError) when calling the ValidateTemplate operation: Template format error: [/Resources/IoTDaasDevicePolicy/Type/PolicyDocument/Statement/2/Resource] map keys must be strings; received a map instead

当我使用Marcin 的答案纠正错误的集团时，验证成功：

{
    "Parameters": [
        {
            "ParameterKey": "vpcname",
            "NoEcho": false,
            "Description": "Enter vpcname"
        },
        {
            "ParameterKey": "taaccountid",
            "NoEcho": false,
            "Description": "Enter TA AccountID\""
        },
        {
            "ParameterKey": "vpcnamefirstletterupper",
            "NoEcho": false,
            "Description": "Enter vpcname with camelcase, ex- \"Usdevms\""
        }
    ],
    "Description": "This template creates IoT policy - attaches to a device certificate, IoT Topic Rule- used to forward messages to sns based on service key, and creates required IAM roles for these.",
    "Capabilities": [
        "CAPABILITY_NAMED_IAM"
    ],
    "CapabilitiesReason": "The following resource(s) require capabilities: [AWS::IAM::Role]"
}