Closed michael-k closed 3 years ago
It could also set the region to the empty string.
Oh, I see that's done in BaseARN
and is also not correct for access points, jobs, and storage lens configurations. I just tried to deploy an access point (with BaseARN
to mitigate the missing account) and it always failed with Policy has invalid resource
. Somehow I didn't notice the missing region and only figured it out after switching from BaseARN
to a plain string¹.
¹ Sub("arn:${AWS::Partition}:s3:${AWS::Region}:${AWS::AccountId}:accesspoint/<access_point_name>/object/*")
awacs.s3.ARN
sets account to the empty string.https://github.com/cloudtools/awacs/blob/aba401851bcba1c92080055091ee627c1a632612/awacs/s3.py#L18-L21