AWS云信息:ses角色的环境条件

Conditions 非常适合将此类条件逻辑添加到CloudFormation资源属性。在您的示例中,可以使用 Fn::If 包含现有 Policy Condition (不要与云形成条件混淆!)如果环境不是 prod 和 AWS::NoValue 否则(当环境为 戳 ):

Parameters:
  Environment:
    Description: Environment, which can be "test", "stage", "prod", etc.
    Type: String
    AllowedValues: [test, stage, prod]
Conditions:
  IsProdEnvironment: !Equals [ !Ref Environment, prod ]
Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: myRole
      Path: /
      AssumeRolePolicyDocument:
         Version: "2012-10-17"
         Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: "ses-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "ses:SendEmail"
                  - "ses:SendRawEmail"
                Resource: "*"
                Condition: !If
                - IsProdEnvironment
                - !Ref AWS::NoValue
                - "ForAllValues:StringLike":
                    "ses:Recipients":
                      - "*@gmail.com"