使用CloudFormation模板中的条件来管理存储桶加密

Question

【以下的问题经过翻译处理】 嗨 AWS，我正试图对S3 `BucketEncryption`属性加入一个条件，无论它是客户管理的（SSE-KMS）还是AWS管理的密钥（SSE-S3）。模板的代码如下：

```
# version: 1.0
AWSTemplateFormatVersion: "2010-09-09"
Description: Create standardized S3 bucket using CloudFormation Template

Parameters:
  BucketName:
    Type: String
    Description: "Name of the S3 bucket"
  KMSKeyArn:
    Type: String
    Description: "KMS Key Arn to encrypt S3 bucket"
    Default: ""
  SSEAlgorithm:
    Type: String
    Description: "Encryption algorithm for KMS"
    AllowedValues:
      - aws:kms
      - AES256

Conditions:
  KMSKeysProvided: !Not [!Equals [!Ref KMSKeyArn, ""]]

Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - !If
          - KMSKeysProvided
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSMasterKeyID: !Ref KMSKeyArn
            BucketKeyEnabled: true
          - !Ref "AWS::NoValue"

```

当我选择SSEAlgorithm为`AES256`时，我收到了这个错误：“**属性ServerSideEncryptionConfiguration不能为空**”。我知道当SSEAlgorithm是AES256类型时，不应该有`KMSMasterKeyID`，但我不知道该怎么摆脱这个错误。

谁能指导一下我吗？多谢

Answer

【以下的回答经过翻译处理】 你好，

希望你一切顺利！

你是正确的。当`SSEAlgorithm`是`AES256`类型时，`KMSMasterKeyID`不应存在。因此，你应该检查`SSEAlgorithm`类型，而不是`KMSKeysProvided`。请检查以下更新后的示例。

```
# 版本: 1.0
AWSTemplateFormatVersion: "2010-09-09"
Description: 使用CloudFormation模板创建标准化的S3存储桶

Parameters:
  BucketName:
    Type: String
    Description: "S3存储桶的名称"
  KMSKeyArn:
    Type: String
    Description: "用于加密S3存储桶的KMS密钥ARN"
    Default: ""
  SSEAlgorithm:
    Type: String
    Description: "KMS加密算法"
    AllowedValues:
      - aws:kms
      - AES256

Conditions:
  KMSKeysProvided: !Not [!Equals [!Ref KMSKeyArn, ""]]

Conditions:
  AES256: !Equals [!Ref SSEAlgorithm, "AES256"]

Resources:
  S3Bucket:
    Type: 'AWS::S3::Bucket'
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      BucketName: !Ref BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption: 
        ServerSideEncryptionConfiguration: 
        - !If
          - AES256
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
            BucketKeyEnabled: true
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !Ref SSEAlgorithm
              KMSMasterKeyID: !Ref KMSKeyArn
            BucketKeyEnabled: true

```

希望这对你有帮助。

使用CloudFormation模板中的条件来管理存储桶加密

Relevanter Inhalt