Merge pull request #437 from kddejong/fix/sub/arns

Resolve some sub arn issues
aws-cloudformation · Jun 17, 2024 · 86d9d1a · 86d9d1a
2 parents da038b3 + df7eb99
commit 86d9d1a
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 30 deletions.
diff --git a/Solutions/ADConnector/templates/ADCONNECTOR.cfn.yaml b/Solutions/ADConnector/templates/ADCONNECTOR.cfn.yaml
@@ -499,14 +499,14 @@ Resources:
               - Effect: Allow
                 Action: s3:GetObject
                 Resource:
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-windows-downloads-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-packages-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::${AWS::Region}-birdwatcher-prod/*
-                  - !Sub arn${AWS::Partition}s3:::patch-baseline-snapshot-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-distributor-file-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-document-attachments-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-windows-downloads-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-packages-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-birdwatcher-prod/*
+                  - !Sub arn:${AWS::Partition}:s3:::patch-baseline-snapshot-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-distributor-file-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-document-attachments-${AWS::Region}/*
         - !If
           - SSMLogsBucketNameCondition
           - PolicyName: SsmLogs
@@ -520,8 +520,8 @@ Resources:
                     - s3:PutObjectAcl
                     - s3:GetEncryptionConfiguration
                   Resource:
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}/*
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}/*
           - !Ref AWS::NoValue
         - PolicyName: ADConnectorLinuxEC2SeamlessDomainJoinSecret
           PolicyDocument:
@@ -628,14 +628,14 @@ Resources:
               - Effect: Allow
                 Action: s3:GetObject
                 Resource:
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-windows-downloads-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-packages-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::${AWS::Region}-birdwatcher-prod/*
-                  - !Sub arn${AWS::Partition}s3:::patch-baseline-snapshot-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-distributor-file-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-document-attachments-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-windows-downloads-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-packages-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-birdwatcher-prod/*
+                  - !Sub arn:${AWS::Partition}:s3:::patch-baseline-snapshot-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-distributor-file-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-document-attachments-${AWS::Region}/*
         - !If
           - SSMLogsBucketNameCondition
           - PolicyName: SsmLogs
@@ -649,8 +649,8 @@ Resources:
                     - s3:PutObjectAcl
                     - s3:GetEncryptionConfiguration
                   Resource:
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}/*
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}/*
           - !Ref AWS::NoValue
     Condition: WindowsEC2DomainJoinResourcesCondition
 

diff --git a/Solutions/ManagedAD/templates/MANAGEDAD.cfn.yaml b/Solutions/ManagedAD/templates/MANAGEDAD.cfn.yaml
@@ -244,14 +244,14 @@ Resources:
               - Effect: Allow
                 Action: s3:GetObject
                 Resource:
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-windows-downloads-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::amazon-ssm-packages-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::${AWS::Region}-birdwatcher-prod/*
-                  - !Sub arn${AWS::Partition}s3:::patch-baseline-snapshot-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-distributor-file-${AWS::Region}/*
-                  - !Sub arn${AWS::Partition}s3:::aws-ssm-document-attachments-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-windows-downloads-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::amazon-ssm-packages-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::${AWS::Region}-birdwatcher-prod/*
+                  - !Sub arn:${AWS::Partition}:s3:::patch-baseline-snapshot-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-distributor-file-${AWS::Region}/*
+                  - !Sub arn:${AWS::Partition}:s3:::aws-ssm-document-attachments-${AWS::Region}/*
         - !If
           - SSMLogsBucketNameCondition
           - PolicyName: SsmLogs
@@ -265,8 +265,8 @@ Resources:
                     - s3:PutObjectAcl
                     - s3:GetEncryptionConfiguration
                   Resource:
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}
-                    - !Sub arn${AWS::Partition}s3:::${SSMLogsBucketName}/*
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}
+                    - !Sub arn:${AWS::Partition}:s3:::${SSMLogsBucketName}/*
           - !Ref AWS::NoValue
         - PolicyName: AWSManagedADLinuxEC2SeamlessDomainJoinSecret
           PolicyDocument: