I want to create an IAM user that acquires the Assumerole. In the case of the uat environment, I want it to acquire the Assumerole for the 123451234512 account, and in the case of stg, I want it to acquire the Assumerole for the 123451234513 account, using a specific AccountId depending on the environment.
When I write the code as below and execute it in CloudFormation, I get a “Syntax errors in policy” error.
AWSTemplateFormatVersion: '2010-09-09'
Description: Create test User
Parameters:
NetworkEnvironment:
Description: test
Type: String
Default: uat
AllowedValues:
- uat
- stg
- prd
Mappings:
AccountMap:
uat:
AccountId: "123451234512"
stg:
AccountId: "123451234513"
prd:
AccountId: "123451234514"
Resources:
User01:
Type: AWS::IAM::User
DeletionPolicy: Retain
Properties:
Path: /
UserName: !Sub ${NetworkEnvironment}-test-user
Tags:
- Key: Name
Value: !Sub ${NetworkEnvironment}-asd
- Key: Environment
Value: !Sub ${NetworkEnvironment}
Policy01:
Type: AWS::IAM::Policy
DeletionPolicy: Retain
Properties:
PolicyName: !Sub ${NetworkEnvironment}-test-policy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- logs:PutLogEvents
- logs:GetLogEvents
Resource: '*'
Users:
- !Ref User01
Policy02:
Type: AWS::IAM::Policy
DeletionPolicy: Retain
Properties:
PolicyName: !Sub ${NetworkEnvironment}-test-assume-role
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action: sts:AssumeRole
Resource: !Sub arn:aws:iam::${!FindInMap [AccountMap, !Ref NetworkEnvironment, AccountId]}:role/testbucket1209
Users:
- !Ref User01
Can somebody help me on this? Thanks!