while parsing a block collection
CloudFormation / YAML error I haven’t seen recently
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Check out my series on Automating Cybersecurity Metrics | Code.
🔒 Related Stories: Bugs | AWS Security | Secure Code | CloudFormation
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
What happened was that I was trying to add an Fn::ForEach to add statements to a KMS key policy for a list of services.
The error is misleading as it throws an error both at the point at which the list of statements start and the point where the For::Each started.
There was no problem with the point where the list started. I had been using that for a while. The problem was this. I inserted the for each without making it a list item like this:
- Sid: Decrypt
Effect: Allow
Principal:
AWS:
!Ref DecryptArnParam
Action:
- 'kms:Decrypt'
- 'kms:DescribeKey'
- !If
- CreateGrantAllowed
- 'kms:CreateGrant'
- !Ref AWS::NoValue
Condition:
!If
- ServiceIsSecretsManager
-
"StringEquals":
"kms:ViaService":
- !Sub "${ServiceParam}.${AWS::Region}.amazonaws.com"
-
!Ref AWS::NoValue
Resource: "*"
#The documentation recommends conditions for CloudFormation but
#did not get that working yet
Fn::ForEach::ServiceCanEncryptLoop:
- Service
- !Ref ServicesCanEncrypt
-
Sid: Allow service to encrypt with KMS key
Effect: Allow
Principal:
Service: !Sub "${Service}.amazonaws.com"
Action:
- kms:GenerateDataKey
- kms:Encrypt
Resource: '*'I needed to add a dash before the Fn::ForEach to make it a valid list item like this:
- Sid: Decrypt
Effect: Allow
Principal:
AWS:
!Ref DecryptArnParam
Action:
- 'kms:Decrypt'
- 'kms:DescribeKey'
- !If
- CreateGrantAllowed
- 'kms:CreateGrant'
- !Ref AWS::NoValue
Condition:
!If
- ServiceIsSecretsManager
-
"StringEquals":
"kms:ViaService":
- !Sub "${ServiceParam}.${AWS::Region}.amazonaws.com"
-
!Ref AWS::NoValue
Resource: "*"
#The documentation recommends conditions for CloudFormation but
#did not get that working yet
- Fn::ForEach::ServiceCanEncryptLoop:
- Service
- !Ref ServicesCanEncrypt
-
Sid: Allow service to encrypt with KMS key
Effect: Allow
Principal:
Service: !Sub "${Service}.amazonaws.com"
Action:
- kms:GenerateDataKey
- kms:Encrypt
Resource: '*'Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
