How to deal with multiple duplicate keys (Fn::Sub) in a aws cloudformation template?

Question

I have a policy that is being made in a cloudformation template. I want to add two resources to the policy, they end up being `arn::bucket` and `arn::bucket/*`. The issue is that the `arn` is a parameter and I get the error: `[cfn-lint] E0000: Duplicate resource found "Fn::Sub" (line 161)`. I understand that it doesn't like the duplicates.

```
"RolePolicies": {
          "Type": "AWS::IAM::Policy",
          "Properties": {
              "PolicyName": "GetGEBucketPutCustomerBucket",
              "PolicyDocument": {
                  "Statement": [
                      {
                          "Action": [
                            "s3:PutObject",
                            "s3:GetObject",
                            "s3:GetObjectAttributes",
                            "s3:GetObjectTagging",
                            "s3:ListBucket",
                            "s3:DeleteObject"
                          ],
                          "Effect": "Allow",
                          "Resource": {
                              "Fn::Sub": [
                                  "${arn}/*",
                                  {
                                      "arn": {
                                          "Ref": "CustomerS3BucketARN"
                                      }
                                  }
                              ],
                              "Fn::Sub": [
                                "${arn}",
                                {
                                    "arn": {
                                        "Ref": "CustomerS3BucketARN"
                                    }
                                }
                            ]
                          }
                      }
                  ]
              },
              "Roles": [
                  {
                      "Ref": "InstanceRole"
                  }
              ]
          },
          "Metadata": {
              "AWS::CloudFormation::Designer": {
                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"
              }
          }
      }
```

However, this cloudformation is allowed to run, but produces errors. When viewing the policy in IAM console window after create, I see that both of the resources were not created.
![IAM Console](/media/postImages/original/IM-C-6juMgR12vBi6kAOuH5Q)

IAM policy editor gives me this error.
`Ln 1, Col 0Missing Version: We recommend that you specify the Version element to help you with debugging permission issues.` since the resource than ends with `/*` wasn't created by cloud formation.

Answer

Hello, when adding multiple resources in the 'Resource' element of an IAM policy statement, to indicate the values to be of type list, in JSON, the comma-separated values have to be enclosed with [ ] and in YAML, individual resources have to be listed with '-'. The above is considered as a single resource with duplicate !Sub leading to the duplicate key issue. Following resource definition worked for me that you can consider testing:

```
"RolePolicies": {
          "Type": "AWS::IAM::Policy",
          "Properties": {
              "PolicyName": "GetGEBucketPutCustomerBucket",
              "PolicyDocument": {
                  "Statement": [
                      {
                          "Action": [
                            "s3:PutObject",
                            "s3:GetObject",
                            "s3:GetObjectAttributes",
                            "s3:GetObjectTagging",
                            "s3:ListBucket",
                            "s3:DeleteObject"
                          ],
                          "Effect": "Allow",
                          "Resource": [
                                {
                                    "Fn::Sub": [
                                        "${arn}",
                                        {
                                            "arn": {
                                                "Ref": "CustomerS3BucketARN"
                                            }
                                        }
                                    ]
                                },
                                {
                                    "Fn::Sub": [
                                        "${arn}/*",
                                        {
                                            "arn": {
                                                "Ref": "CustomerS3BucketARN"
                                            }
                                        }
                                    ]
                                }
                            ]
                      }
                  ]
              },
              "Roles": [
                  {
                      "Ref": "InstanceRole"
                  }
              ]
          },
          "Metadata": {
              "AWS::CloudFormation::Designer": {
                  "id": "a713fcc6-95c8-423f-a5b8-0020a81e5ce4"
              }
          }
      }
```

How to deal with multiple duplicate keys (Fn::Sub) in a aws cloudformation template?

Relevant content