Amazon web services AWS云信息替代VPCEndPoint策略

我想创建S3 bucket并为此bucket创建端点

我对资源的定义如下：

myS3Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'my-${ENVL}-${AWS::AccountId}'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
    DeletionPolicy: Delete
  myS3VpcEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument: '{
        "Version":"2012-10-17",
        "Statement":[{
          "Effect":"Allow",
          "Principal": "*",
          "Action":["s3:*"],
          "Resource":!Sub ["${!GetAtt myS3Bucket.Arn}/*"]
        }]
      }'
      RouteTableIds:
        - !Ref myIntRouteTable
        - !Ref myPriRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref myVPC

如何在策略对象中引用我的s3存储桶

“资源”：！Sub[“${！GetAtt myS3Bucket.Arn}/*”]不工作

---

谢谢，帕里，这很简单，我又看了一遍亚马尔

PolicyDocument: !Sub 
    - '{
        "Version":"2008-10-17",
        "Statement":[{
        "Effect":"Allow",
        "Principal": "*",
        "Action": "s3:*",
        "Resource": ["arn:aws:s3:::${s3Bucket}", "arn:aws:s3:::${s3Bucket}/*"]
        }]
    }'
    - {s3Bucket: !Sub "my-${ENVL}-${AWS::AccountId}"}