CloudFormation Null Condition

Question

When running the following as part of a CloudFormation script I get an error:
```
          - Sid: 'DenyUnEncryptedObjectUploads'
            Effect: 'Deny'
            Principal: '*'
            Action: 's3:PutObject'
            Resource: '*'
            Condition:
              Null:
                s3:x-amz-server-side-encryption: 'true'
```
The error reported when attempting to create a stack (CloudFormation > Stacks > Create stack) is:
Template format error: [/Resources/BucketPolicy/Properties/PolicyDocument/Statement/2/Condition] encountered malformed key

It should be noted that the policy already exists against some manually created S3 buckets that were generated donkey's years ago, but I'm trying to replicate the existing infrastructure in a new region using CloudFormation.

I have found that changing the condition to ForAllValues:Null: or ForAnyValue:Null: appears to be acceptable, but these don't fit our use case.

Any help in understanding why this is failing or help in correcting the code will be appreciated.

Leo K · Accepted Answer

`Null` is a reserved word in YAML. You have to put it in single quotes or double quotes:

```
          - Sid: 'DenyUnEncryptedObjectUploads'
            Effect: 'Deny'
            Principal: '*'
            Action: 's3:PutObject'
            Resource: '*'
            Condition:
              'Null':
                s3:x-amz-server-side-encryption: 'true'
```

Glenn Comiskey · Answer

Many thanks, Leo, problem sorted; and as is usual with most things, a simple solution to resolve the issue.

CloudFormation Null Condition

Add your answer

Relevant content