Transforming a CommaDelimitedList of Roles to list of Arns in Cloudformation

Question

I have a cloudformation template generating a kms key with a policy document to grant roles access to the key. Now I want the roles to be a CommaDelimitedList Parameter of the Cloudformation template and I do not know the size in advanced. So I have input like this:

["role1", "role2", ...]

and have to generate this:

Principal:
  AWS:
  - !Sub "arn:aws:iam::${AWS::AccountId}:role/role1",
  - !Sub "arn:aws:iam::${AWS::AccountId}:role/role2",
  ...

Is this transformation possible in cloudformation?

Answer 1

Not possible.

What you need to do is to pass the ARNs list. For example:

SomeParam:
    "Fn::Join":
        - ","
        -
            - !GetAtt "role1.Arn"
            - !GetAtt "role2.Arn"

And just use it directly, CommaDelimitedList is automatically transformed into list by CloudFormation when passed as a parameter:

Principal:
    AWS: !Ref "RolesParameter"

If you have just role names, you need to build the ARNs on your own, like in your question, but before passing as an argument:

SomeParam:
    "Fn::Join":
        - ","
        -
            - !Sub "arn:aws:iam::${AWS::AccountId}:role/role1"
            - !Sub "arn:aws:iam::${AWS::AccountId}:role/role2"