title: How do I supply different conditions based on a parameter in an IAM Role CloudFormation Template
body: <p>I'm writing a CloudFormation template for an IAM role that I will assume through STS. I need to add a condition where a key equals a value, where both the key and value depends on a "Stage" parameter. The value I've been able to programmatically change depending on the parameter, but all my attempts to change the key based on Stage have failed.</p>
  
  <p>I've tried both using a map and !FindInMap to get the correct key, as well as tried to construct a condition with both cases using !If.</p>
  
  <p>In the first case...</p>
  
  <pre><code>Mappings:
    Constants:
      beta:
        Id: "beta.example.com"
        Endpoint: "beta-link.example.com/api/oauth2/v2:aud"
      prod:
        Id: "example.com"
        Endpoint: "link.example.com/api/oauth2/v2:aud"
  
  AssumeRolePolicyDocument:
    Statement:
      Action:
        - "sts:AssumeRoleWithWebIdentity"
      Condition:
        StringEquals:
          !FindInMap [Constants, !Ref Stage, Endpoint]:
            - !FindInMap [Constants, !Ref Stage, Id]
  </code></pre>
  
  <p>... I got an error: <code>map keys must be strings; received a map instead</code></p>
  
  <p>In the second case...</p>
  
  <pre><code>AssumeRolePolicyDocument:
    Statement:
      Action:
        - "sts:AssumeRoleWithWebIdentity"
      Condition:
        !If
          - !Equals [!Ref Stage, prod]
          - StringEquals:
            "link.example.com/api/oauth2/v2:aud": "example.com"
          - StringEquals:
            "beta-link.example.com/api/oauth2/v2:aud": "beta.example.com"
  </code></pre>
  
  <p>...I got another error: <code>Template format error: Conditions can only be boolean operations on parameters and other conditions</code></p>
  
  <p>In short, how can I specify a condition where both key and value depend on a parameter?</p>