CODEWITHSUNDEEP
amazon-sesaws-cloudformation
Justin
Justin

Reputation: 2404

AWS CloudFormation environmental conditional for ses role

I'm trying to make a reusable CloudFormation template and would like to do some kind of conditional where if the Environment parameter is "test" (or any other environment other than "prod"), then send SES emails to only gmail accounts (i.e., corporate accounts), but for "prod", send SES emails anywhere. Would I have to do two different roles and have conditions on each one? Or is there a way to do this inside of just the one role below? Thanks for any help!

Parameters: 

  Environment:
    Description: Environment, which can be "test", "stage", "prod", etc.
    Type: String

 Resources:

   Role: 
    Type: AWS::IAM::Role
    Properties: 
    RoleName: myRole
    Path: /
    AssumeRolePolicyDocument: 
       Version: "2012-10-17"
       Statement:
        - 
          Effect: "Allow"
          Principal: 
            Service: 
              - "ecs.amazonaws.com"
          Action: 
            - "sts:AssumeRole" 
    Policies: 
      - 
        PolicyName: "ses-policy"
        PolicyDocument:
          Version: "2012-10-17"
          Statement: 
            -
              Effect: "Allow"
              Action: 
                - "ses:SendEmail"
                - "ses:SendRawEmail"
              Resource: "*"
              Condition:
                "ForAllValues:StringLike": 
                  "ses:Recipients": 
                    - "*@gmail.com"

Upvotes: 1

Views: 1547

Answers (1)

wjordan
wjordan

Reputation: 20390

Conditions are perfectly suited for adding this sort of conditional logic to CloudFormation Resource Properties. In your example, you could use the Fn::If Intrinsic Function to include the existing Policy Condition (not to be confused with the CloudFormation Condition!) if the environment is not prod, and AWS::NoValue otherwise (removing the Policy Condition entirely when environment is prod):

Parameters:
  Environment:
    Description: Environment, which can be "test", "stage", "prod", etc.
    Type: String
    AllowedValues: [test, stage, prod]
Conditions:
  IsProdEnvironment: !Equals [ !Ref Environment, prod ]
Resources:
  Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: myRole
      Path: /
      AssumeRolePolicyDocument:
         Version: "2012-10-17"
         Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Policies:
        -
          PolicyName: "ses-policy"
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action:
                  - "ses:SendEmail"
                  - "ses:SendRawEmail"
                Resource: "*"
                Condition: !If
                - IsProdEnvironment
                - !Ref AWS::NoValue
                - "ForAllValues:StringLike":
                    "ses:Recipients":
                      - "*@gmail.com"

Upvotes: 3

Related Questions