title: How to ImportValue in trust relationship
body: <p>I have exported a value from another stack and trying to import in &quot;AssumeRolePolicyDocument&quot; in cloudformation role, tried many ways but getting below error</p>
  <p>&quot;Syntax error at position (1,195) (Service: AmazonIdentityManagement; Status Code: 400; Error Code: MalformedPolicyDocument; Request ID: b1b4b5ef-88ef-444b-8aa7-0548ce0002a6; Proxy: null)&quot;</p>
  <pre><code>  EksAutoscalerRole: 
      Type: AWS::IAM::Role
      Properties:
        RoleName: Eks-Autoscaler-Role
        Path: &quot;/&quot;
        AssumeRolePolicyDocument: 
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Principal:
              Federated: 
                'Fn::Sub':
                - 'arn:aws:iam::1122334455:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/${oidc}'
                - oidc: 
                    &quot;Fn::ImportValue&quot;: EksOidc
            Action: 'sts:AssumeRoleWithWebIdentity'
            Condition:
              StringEquals:   
                'Fn::Sub': 
                - 'oidc.eks.us-east-1.amazonaws.com/id/${oidc}:sub: system:serviceaccount:kube-system:cluster-autoscaler'
                - oidc: 
                    &quot;Fn::ImportValue&quot;: EksOidc
        ManagedPolicyArns:
        - !Ref EksAutoscalerPolicy
  </code></pre>
  <p>Tried below ways too:
  <a href="https://stackoverflow.com/questions/61290926/insert-a-cloudformation-importvalue-similar-to-how-you-can-insert-a-parameter">Insert a CloudFormation ImportValue similar to how you can insert a Parameter?</a></p>
  <p><em><strong>UPDATED</strong></em>
  Tried below code worked now.</p>
  <pre><code>  EksAutoscalerRole: 
      Type: AWS::IAM::Role
      Properties:
        RoleName: Eks-Autoscaler-Role
        Path: /
        AssumeRolePolicyDocument: 
          &quot;Fn::Sub&quot;:
          - '{
              &quot;Version&quot;: &quot;2012-10-17&quot;,
              &quot;Statement&quot;: [
                  {
                      &quot;Effect&quot;: &quot;Allow&quot;,
                      &quot;Principal&quot;: {
                          &quot;Federated&quot;: &quot;${EksAutoscalerProvider}&quot;
                      },
                      &quot;Action&quot;: &quot;sts:AssumeRoleWithWebIdentity&quot;,
                      &quot;Condition&quot;: {
                          &quot;StringEquals&quot;: {
                              &quot;oidc.eks.${AWS::Region}.amazonaws.com/id/${oidcNo}:sub&quot;: &quot;system:serviceaccount:kube-system:cluster-autoscaler&quot;
                          }
                      }
                  }
              ]
            }'
          - oidcNo: !Select [0, !Split [&quot;.&quot;, !Select [1, !Split [&quot;//&quot;, !GetAtt EksCluster.Endpoint]]]]
        ManagedPolicyArns:
        - !Ref EksAutoscalerPolicy
  </code></pre>