How to specify string like conditions with AWS parameters

[edfanchermat]

I used a tool (rain) to convert a JSON managed policy template to a PKL one, and it converted this condition:
"Condition": {
"StringLike": {
aws:ResourceTag/owners: "someattribute"
}
}

Like this:
Condition {
StringLike {
aws:ResourceTag/owners = "someattribute"
}
}

PKL doesn't like the slash. I'm not sure what the correct way to specify this condition in cloud formation pickle is.

[ericzbeard]

Can you provide a complete template to use as a repro?

[edfanchermat]

I get this error when trying to deploy through rain: [recovered] panic: error packaging template 'Kops/iam/RepoTemplate.pkl': __ Pkl Error __ No viable alternative at input `PolicyDocument {\n Statement {\n new {\n Action {\n "secretsmanager:*"\n }\n Condition {\n StringLike {\n aws:ResourceTag/` 33 | aws:ResourceTag/owners = "*attributevalue*" ^

…

On Wed, Jul 10, 2024 at 2:58 PM Eric Z. Beard ***@***.***> wrote: Can you provide a complete template to use as a repro? — Reply to this email directly, view it on GitHub <#12 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AMABDHCUQ2BZKR2EDQ4C7BLZLWU7TAVCNFSM6AAAAABKVPG2PKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMBRGQ3DQNY> . You are receiving this because you authored the thread.Message ID: <aws-cloudformation/cloudformation-pkl/repo-discussions/12/comments/10014687 @github.com>

[edfanchermat]

converted using rain format RepoTemplate --pkl > RepoTemplate.pkl deployed using rain deploy RepoTemplate.pkl --debug RepoTemplate On Wed, Jul 10, 2024 at 3:38 PM Ed Fancher ***@***.***> wrote:

…

I get this error when trying to deploy through rain: [recovered] panic: error packaging template 'Kops/iam/RepoTemplate.pkl': __ Pkl Error __ No viable alternative at input `PolicyDocument {\n Statement {\n new {\n Action {\n "secretsmanager:*"\n }\n Condition {\n StringLike {\n aws:ResourceTag/` 33 | aws:ResourceTag/owners = "*attributevalue*" ^ On Wed, Jul 10, 2024 at 2:58 PM Eric Z. Beard ***@***.***> wrote: > Can you provide a complete template to use as a repro? > > — > Reply to this email directly, view it on GitHub > <#12 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AMABDHCUQ2BZKR2EDQ4C7BLZLWU7TAVCNFSM6AAAAABKVPG2PKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMBRGQ3DQNY> > . > You are receiving this because you authored the thread.Message ID: > <aws-cloudformation/cloudformation-pkl/repo-discussions/12/comments/10014687 > @github.com> >

[edfanchermat]

RepoTemplate. (json)

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Metadata": {
    },
    "Resources": {

        "TempRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "RoleName": "TempRole",
            },
            "Metadata": {
            }
        },
        "TempManagedPolicy": {
            "Type": "AWS::IAM::ManagedPolicy",
            "Properties": {
                "Roles": [
                    {
                        "Ref": "TempRole"
                    }
                ],
                "ManagedPolicyName": "TempManagedPolicy",
                "PolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "secretsmanager:*"
                            ],
                            "Condition": {
                                "StringLike": {
                                    "aws:ResourceTag/owners": "*attributevalue*"
                                }
                            },
                            "Effect": "Allow",
                            "Resource": "*",
                            "Sid": "AllowOwnersFullAccess"
                        }
                    ],
                    "Version": "2012-10-17"
                }
            },
            "Metadata": {
            }
        }
    }
}

RepoTemplate.pkl

amends "@cfn/template.pkl"
import "@cfn/cloudformation.pkl" as cfn
import "@cfn/aws/iam/role.pkl"
import "@cfn/aws/iam/managedpolicy.pkl"

AWSTemplateFormatVersion = "2010-09-09"

Metadata {
}

Resources {
    ["TempRole"] = new role.Role {
        Type = "AWS::IAM::Role"
        RoleName = "TempRole"
        Metadata {
        }
    }

    ["TempManagedPolicy"] = new managedpolicy.ManagedPolicy {
        Type = "AWS::IAM::ManagedPolicy"
        Roles {
            cfn.Ref("TempRole")
        }
        ManagedPolicyName = "TempManagedPolicy"
        PolicyDocument {
            Statement {
                     new {
                        Action {
                                "secretsmanager:*"
                            }
                        Condition {
                                StringLike {
                                        aws:ResourceTag/owners = "*attributevalue*"
                                    }
                            }
                        Effect = "Allow"
                        Resource = "*"
                        Sid = "AllowOwnersFullAccess"
                    }
                }
            Version = "2012-10-17"
        }
        Metadata {
        }
    }

}

[ericzbeard]

If you add the --pkl-basic flag to output Pkl without the use of modules, you get this, which works:

                        ["Condition"] {
                            ["StringLike"] {
                                ["aws:ResourceTag/owners"] = "*attributevalue*"
                            }
                        }

I need to see why the default behavior assumes that the string is an object key.

[edfanchermat]

Worked on my actual template too. Thanks!

…

On Wed, Jul 10, 2024 at 3:59 PM Eric Z. Beard ***@***.***> wrote: If you add the --pkl-basic flag to output Pkl without the use of modules, you get this, which works: ["Condition"] { ["StringLike"] { ["aws:ResourceTag/owners"] = "*attributevalue*" } } I need to see why the default behavior assumes that the string is an object key. — Reply to this email directly, view it on GitHub <#12 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AMABDHCRK7K5OFMHY22PB5DZLW4FRAVCNFSM6AAAAABKVPG2PKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTAMBRGQ4TSNI> . You are receiving this because you authored the thread.Message ID: <aws-cloudformation/cloudformation-pkl/repo-discussions/12/comments/10014995 @github.com>

[ericzbeard]

Fixed in rain v1.12.0. https://github.com/aws-cloudformation/rain/releases/tag/v1.12.0