How to ImportValue in trust relationship

Question

I have exported a value from another stack and trying to import in "AssumeRolePolicyDocument" in cloudformation role, tried many ways but getting below error

"Syntax error at position (1,195) (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: b1b4b5ef-88ef-444b-8aa7-0548ce0002a6; Proxy: null)"

  EksAutoscalerRole: 
    Type: AWS::IAM::Role
    Properties:
      RoleName: Eks-Autoscaler-Role
      Path: "/"
      AssumeRolePolicyDocument: 
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Federated: 
              'Fn::Sub':
              - 'arn:aws:iam::1122334455:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/${oidc}'
              - oidc: 
                  "Fn::ImportValue": EksOidc
          Action: 'sts:AssumeRoleWithWebIdentity'
          Condition:
            StringEquals:   
              'Fn::Sub': 
              - 'oidc.eks.us-east-1.amazonaws.com/id/${oidc}:sub: system:serviceaccount:kube-system:cluster-autoscaler'
              - oidc: 
                  "Fn::ImportValue": EksOidc
      ManagedPolicyArns:
      - !Ref EksAutoscalerPolicy

Tried below ways too: Insert a CloudFormation ImportValue similar to how you can insert a Parameter?

UPDATED Tried below code worked now.

  EksAutoscalerRole: 
    Type: AWS::IAM::Role
    Properties:
      RoleName: Eks-Autoscaler-Role
      Path: /
      AssumeRolePolicyDocument: 
        "Fn::Sub":
        - '{
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Federated": "${EksAutoscalerProvider}"
                    },
                    "Action": "sts:AssumeRoleWithWebIdentity",
                    "Condition": {
                        "StringEquals": {
                            "oidc.eks.${AWS::Region}.amazonaws.com/id/${oidcNo}:sub": "system:serviceaccount:kube-system:cluster-autoscaler"
                        }
                    }
                }
            ]
          }'
        - oidcNo: !Select [0, !Split [".", !Select [1, !Split ["//", !GetAtt EksCluster.Endpoint]]]]
      ManagedPolicyArns:
      - !Ref EksAutoscalerPolicy

I noticed that in your answer you don't use ImportValue. How are you getting the values from the other stack? — Stuart Buckingham, Apr 25 '23 at 01:15
I think I found the answer in this snippet https://github.com/applerom/cloudformation-examples/blob/master/amp/prometheus-eks-access.yml — Stuart Buckingham, Apr 25 '23 at 01:19

score 0 · Answer 1 · answered Mar 14 '22 at 23:15

0

Check your indentation. The Sub function should be indented like this according to the documentation:

Fn::Sub:
  - String
  - Var1Name: Var1Value
    Var2Name: Var2Value

answered Mar 14 '22 at 23:15

Shawn

8,374
5
37
60

How to ImportValue in trust relationship

1 Answers1