How to reference a resource ARN in a cloudformation policy document ? (yaml)

Question

I am trying to define a trust relationship policy document between a role and a user in cloudformation (yaml).

For specifying the ARN of the user in the role's AssumeRolePolicyDocument, I want to reference the ARN from the actual cloudformation resource, instead of having to construct the ARN string.

But, it doesn't work. When I use !Ref rUser, I get an error when creating the cloudformation stack "invalid principal in policy".

When I just paste the ARN string as the value, it works. Is it because !Ref rUser returns a user object type and does not evaluate to a string? If so, how can I reference the ARN from the resource?

Code:

  rUser:
    Type: "AWS::IAM::User"
    Properties:
      UserName: "my_user"

  rRole:
    DependsOn: rRole
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "my_role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              AWS:
                # this does not work, gives error "Invalid Principal in policy"
                - !Ref rUser
                # this does work (just hard coding the ARN string):
                # - "arn:aws:iam::111111111111:user/my_user"
            Action:
              - "sts:AssumeRole"

score 40 · Accepted Answer · answered Nov 28 '19 at 23:05

40

Just figured it out ... quite simple using the GetAtt function:

  rRole:
    DependsOn: rRole
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: "my_role"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              AWS:
                - !GetAtt rExternalUser.Arn  # use the GetAtt function
            Action:
              - "sts:AssumeRole"

answered Nov 28 '19 at 23:05

James Wierzba

16,176
14
79
120

1

do you have any idea how to use the `!GetAtt` in typescript land ? – Renan Cidale Jun 10 '21 at 10:54
@RenanCidale it would be same as json { "Fn::GetAtt": ["rExternalUser", "Arn"] }, please refer to aws json docs here https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html – Khuram Niaz Oct 17 '22 at 01:20

How to reference a resource ARN in a cloudformation policy document ? (yaml)

1 Answers1