How to add 'Always Required' Values to a CommaDelimitedList - aws-cloudformation

Question

I'm attempting to create an IAM Policy for limiting access to selected S3 Buckets. There are some default S3 Bucket ARNs, that must always be present, the template operator is allowed to add a list of additional Bucket ARNs to grant access to, through a Parameter.
In my template the BucketARNs Parameter, allows the operator to specify a list of ARN that is not limited in length.
BucketARNs:
Type: CommaDelimitedList
Description: 'Add the ARN of S3 Buckets that the Get* and List*
access to. When specifying a Bucket 2 values should be supplied one for the
bucket and for objects within that bucket, for example: arn:aws:s3:::MyContentBucket,arn:aws:s3:::MyContentBucket/* .
This defaults to all buckets.'
Default: arn:aws:s3:::*, arn:aws:s3:::*/*
The policy document that uses this Parameter looks like
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:Get*
- s3:List*
Resource:
!Ref BucketARNs
I want to do is ensure that, for example
arn:aws:s3:::MyMustHaveBucket,
arn:aws:s3:::MyMustHaveBucket/*
ARNs are always present in the list of BucketARNs. The Default in the Parameter can be removed by the operator - Is the only solution to add them as Default values and add information in the Parameter Description warning users not to remove the required ARNs? Which like it could be easily broken.
Does anyone know a way of ensuring I always have these available? considering the list of BucketARNs specified via the Parameter is variable?
Ideally, I'd like a list concatenation function

Answer 1

Two options:
You can use AllowedPattern on a String Parameter along with a Default value to ensure that the provided default is always included in the supplied parameter, then use Fn::Split to resolve the parameter into an array when used in your template:
Parameters:
BucketARNs:
Type: String
Default: arn:aws:s3:::*, arn:aws:s3:::*/*
AllowedPattern: arn:aws:s3:::\*, arn:aws:s3:::\*\/\*.*
Resources:
Dummy:
Type: AWS::CloudFormation::WaitConditionHandle
Outputs:
Result:
Value: !Join [',', !Split [',', !Ref BucketARNs]]
You can use Fn::Split along with Fn::Sub and Fn::Join to append your fixed values to a user-supplied Parameter:
Parameters:
BucketARNs:
Type: CommaDelimitedList
Resources:
Dummy:
Type: AWS::CloudFormation::WaitConditionHandle
Outputs:
Result:
Value: !Join [',', !Split [',', !Sub [
"arn:aws:s3:::*,arn:aws:s3:::*/*,${Buckets}",
{Buckets: !Join [',', !Ref BucketARNs]}
]]]
The final !Join in the above examples are only to output the Array in the Stack Output, they're not needed when using the parameters in an actual property input to your template.

Answer 2

Use FN::join to concatenate the constants with the parameters