Cloudformation replacement issue causes 403

[nfillot]

Hello,

I tried to use the kubecost-single-account-permissions Cloudformation template but i had an issue resulting in a 403 in Kubecost due to wrong IAM permissions

Cloudformation does not replace AthenaCURBucket to the wanted target. Here is the result in the IAM policy :

        {
            "Action": [
                "s3:Get*",
                "s3:List*"
            ],
            "Resource": [
                "arn:aws:s3:::${AthenaCURBucket}*"
            ],
            "Effect": "Allow",
            "Sid": "S3ReadAccessToAwsBillingData"
        }

It works by replacing this part to the following syntax

        - Sid: S3ReadAccessToAwsBillingData
          Effect: Allow
          Action:
          - s3:Get*
          - s3:List*
          Resource:
            'Fn::Join':
              - ''
              - - 'arn:aws:s3:::'
                - !Ref AthenaCURBucket
                - "*"

Best regards

[dwbrown2]

Thanks for reporting, @nfillot! We'll start investigating now.

[AjayTripathy]

Hi @nfillot thanks for spotting-- this should now be corrected using the !Sub function in ddb907a