Reputation: 49
I am creating ssm parameter in a different stack that stores a kms key , Now I want to use this ssm parameter to be resolved in a different stack if it is available else leave it empty.
Stack 1:
KmsKeySSM:
Type: AWS::SSM::Parameter
Condition: EnableTrans
Properties:
Description: ETL Glue Job Security Config Kms Key
Name: !Sub '/app/glue/etljob/${ProcessType}/${ApplicationName}/kmskey'
Type: String
Value: !GetAtt GlueJobKmsKey.Arn
Stack 2:
AWSGlueJobRole:
Type: "AWS::IAM::Role"
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- glue.amazonaws.com
Action:
- sts:AssumeRole
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole
- arn:aws:iam::aws:policy/AWSLakeFormationDataAdmin
Policies:
- PolicyName: !Sub app-dih-iceberg-kmspolicy-gluecatalog-${ApplicationName}
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- "kms:DescribeKey*"
- "kms:Encrypt*"
- "kms:Decrypt*"
- "kms:ReEncrypt*"
- "kms:GenerateDataKey*"
- "kms:GenerateDataKeyWithoutPlaintext"
Resource:
- !Sub '{{resolve:ssm:/app/dev/glue-catalog/kms}}'
- !Sub '{{resolve:ssm:/app/dev/central-catalog/glue/kms}}'
- !If [!Sub '{{resolve:ssm://app/glue/etljob/trans/${ApplicationName}/kmskey']
here in resource I want to check if the stack 1 SSM parameter exists else leave it empty or dont use it like this I have two ssm parameters that I want to refer conditionally
I dont want to use an extra parameter in this case.
Upvotes: 0
Views: 16