AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  Users:
    Type: CommaDelimitedList
Rules:
  AtLeastOneUserSpecified:
    Assertions:
      - Assert: !Not [!Contains [!Ref Users, ""]]  # don't fail in Rules section
        AssertDescription: Must specify at least one user
Resources:
  Bucket:
    Type: "AWS::S3::Bucket"
    Properties:
      Tags:
        - Key: BucketUsers
          Value: !Join [":", !Ref Users]