aws-ia / cfn-ps-microsoft-iis Goto Github PK

With default parameters, QSS3BucketName is set to aws-ia in iis-main.template.yaml. This is passed through verbatim to IISStack, which launches further sub-stacks like:

  SecurityStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Sub 'https://${QSS3BucketName}.s3.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/security.template.yaml'

That template URL resolves to https://aws-ia.s3.amazonaws.com/cfn-ps-microsoft-iis/templates/security.template.yaml, which gives a 403. It seems that either assets are missing in that bucket or permissions are misconfigured.

Modifying the first nested stack (IISStack)'s parameter value for QSS3BucketName from

          QSS3BucketName: !Ref 'QSS3BucketName'

to

          QSS3BucketName: !If
              - UsingDefaultBucket
              - !Sub '${QSS3BucketName}-${AWS::Region}'
              - !Ref QSS3BucketName

(as is done for the URL of the IISStack template in the outer stack)
appears to resolve the issue.

I haven't submitted a PR for this, since it would be more desirable to also pass QSS3BucketRegion through to the child stacks so the S3 regional endpoint is used (instead of relying on S3's redirect behaviour, which CloudFormation does allow).