Custom resource name for IAM role defined in user-pool-group-precedence.json Amplify

Question

I have an Amplify project and want to have a custom resource string per environment. For example I have the below defined in my user-pool-group-precedence.json file:

[{
    "groupName": "example",
    "precedence": 1,
    "customPolicies": [
      {
        "PolicyName": "example-policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "Policy01",
              "Action": ["s3:GetObject"],
              "Resource": ["arn:aws:s3:::s3bucket-*/"],
              "Effect": "Allow"
            }
         ]
      }
    ]
}]

I have multiple s3 buckets (1 per environment). For example s3bucket-dev and s3bucket-qa. Currently the above policy grants access to all my s3 buckets in different environments. How do I go about defining a single bucket per environment? Ideally I want something like

arn:aws:s3:::s3bucket-${aws:env}/

I looked at using conditions but was unsure how to implement them in order to achieve my goal.

Answer 1

Since this policy will be added to the amplify cloudformation template, Amplify already provides the parameter env in that target template. I suppose you will just have to reference it in your policy like this to make it dynamic as per your environment (Fn::Join does what you need):

[{
    "groupName": "example",
    "precedence": 1,
    "customPolicies": [
      {
        "PolicyName": "example-policy",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "Policy01",
              "Action": ["s3:GetObject"],
              "Resource": {
                 "Fn::Join": [
                    "",
                    [
                      "arn:aws:s3:::s3bucket-",
                      {
                        "Ref": "env"
                      },
                      "/"
                    ]
                 ]
              },
              "Effect": "Allow"
            }
         ]
      }
    ]
}]