GetAtt not supported for: RdsDbCluster.MasterUserSecret.SecretArn

[jlongland]

I have a template with a policy that references an RDS MasterUserSecret

    - Effect: Allow
      Action:
      - secretsmanager:GetSecretValue
      Resource:
      - !GetAtt RdsDbCluster.MasterUserSecret.SecretArn

I receive an error when validating:

ERROR: Call to GetAtt not supported for: RdsDbCluster.MasterUserSecret.SecretArn

[mfonsen]

The problem could be that the GetAtt validation logic has very limited support for attributes that are not direct properties of any CloudFormation resources.

All such attribute types are listed in: https://github.com/awslabs/aws-cloudformation-iam-policy-validator/blob/main/cfn_policy_validator/parsers/utils/intrinsic_functions/fn_get_att_evaluator.py#L22

Currently there's just one.

Bumped into this problem because AWS CDK VPC construct by default creates a template that uses GetAtt DefaultSecurityGroup on a AWS::EC2::VPC.