AWS CDK如何在IAM策略中包含主体?

2024-03-29 05:29:54 发布

您现在位置:Python中文网/ 问答频道 /正文

嗨,我在AWS CDK工作。我正在尝试创建基于资源的策略。下面是我的云形成模板。你知道吗

MWSECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: "location/location-service"
      RepositoryPolicyText:
        Version: "2012-10-17"
        Statement:
          - Sid: CurrentAccountPush
            Effect: Allow
            Principal:
              AWS:
                - 'arn:aws:iam::1234:root'  # dev
                - 'arn:aws:iam::1234:root'  # nonprod
                - 'arn:aws:iam::1234:root'  # prod
            Action:
              - 'ecr:GetDownloadUrlForLayer'
              - 'ecr:PutImage'
              - 'ecr:InitiateLayerUpload'
              - 'ecr:UploadLayerPart'
              - 'ecr:CompleteLayerUpload'

下面我尝试使用CDK创建相同的。你知道吗

 ECRRepository = ecr.Repository(self, id = "ECR", repository_name = "location/location-service");
        ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
            principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
        ));


        ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            #principals=["arn:aws:iam::123:root","arn:aws:iam::123:root","arn:aws:iam::123:root"]
            actions=["ecr:GetDownloadUrlForLayer","ecr:BatchGetImage","ecr:BatchCheckLayerAvailability"]
        ));

        ECRRepository.add_lifecycle_rule(description="Image retention",  max_image_count=100, rule_priority=1);

这将导致以下错误

Error: Expected object reference, got "arn:aws:iam::123:root"

有人能帮我用python写正确的语法吗?任何帮助都将不胜感激。谢谢


Tags: awsaddrepositoryservicelocationrootiamarn
1条回答
网友
1楼 · 发布于 2024-03-29 05:29:54

principals需要是IPrincipal的列表,而不是strings

ECRRepository.add_to_resource_policy(iam.PolicyStatement(
            effect=iam.Effect.ALLOW,
            actions=["ecr:GetDownloadUrlForLayer","ecr:PutImage","ecr:InitiateLayerUpload","ecr:UploadLayerPart","ecr:CompleteLayerUpload"],
            principals=[iam.ArnPrincipal("aws:iam::1234:root")]
        ));

相关问题 更多 >