Question

我对Amazon cloud formation技术不熟悉我目前的任务是使用具有IAM角色的Amazon Cloud Formation在Java SDK上创建堆栈。在 AWS CLI 上，我可以通过添加其他参数 - profile 来创建亚马逊云形成。我在配置文件中创建了一个包含 role-arn 的配置文件，如下面的link所述。

现在我想使用AWS中的Java SDK实现相同的功能。我在Java中的 堆栈请求 如下

CreateStackRequest r = new CreateStackRequest();
r.withStackName(getStackName());
r.withParameters(getParameters());
r.withTemplateURL(getTemplate());
r.withCapabilities(getCapabilities());
r.withRoleARN(getArnRole());

我的 亚马逊云形成 客户端初始化如下

amazonClient=AmazonCloudFormationClientBuilder.standard()
             .withCredentials(new ProfileCredentialsProvider())
             .withRegion(Regions.US_EAST_1)
             .build();

但我无法创建亚马逊云形成，因为它给了我以下错误

Exception in thread "main" com.amazonaws.services.cloudformation.model.AmazonCloudFormationException:
User: arn:aws:iam::xxxxxxx:user/xxxxxxx is not authorized to perform: iam:PassRole
on resource: arn:aws:iam::xxxxx:role/xxxxxxxx (Service: AmazonCloudFormation;
Status Code: 403; Error Code: AccessDenied; Request ID: xxxxxxxxxx)

有人能让我知道我做错了什么吗？

修改

AWS CLI

我在本地Windows系统上安装了AWS SDK。要在aws cli上执行cloud formation命令，我正在执行以下操作

aws cloudformation create-stack  --stack-name xxxxx
--template-url xxxxxxxx 
--capabilities "CAPABILITY_IAM" --parameters xxxxxx --profile xxxxxxx

template and parameters以json格式存储在s3存储桶中。当我运行上面的命令行时，我得到了以下output

{
  "StackId": "xxxxxxx"
}

AWS Java SDK

我创建了一个Java代码，它将以下命令作为命令行参数

--stack-name xxxxxx--template-url xxxxx 
--capabilities "CAPABILITY_IAM" --parameters xxxxx 
--profile xxxxxx --access-key xxxxxxx --secret-key xxxxxxxx

我的AWS config file如下

 [default]
 output = json
 region = us-east-1
 [profile xxxxx]
 role_arn = arn:aws:iam::xxxxxxx:role/xxxxxxxx
 source_profile = default
 region = us-east-1

我的AWS credentials file如下

 [default]
 aws_access_key_id = xxxxxx
 aws_secret_access_key = xxxxxx
 [profile xxxxxx]
 aws_access_key_id = xxxxxx
 aws_secret_access_key = xxxxxxx

在 亚马逊云形成 客户端initialisation中，我尝试了以下

 1. amazonClient=AmazonCloudFormationClientBuilder.standard()
             .withCredentials(new ProfileCredentialsProvider())
             .withRegion(Regions.US_EAST_1)
             .build();

 2. BasicAWSCredentials  credentials=new BasicAWSCredentials(accessKey,secretKey); 
   AmazonCloudFormationClientBuilder.standard().withCredentials(new 
   AWSStaticCredentialsProvider(credentials)).build();

在initialisations中，我都有相同的错误。

Answer 1

您可以使用AWS CloudFormation Java API V2创建新的Cloud Formation堆栈。要运行此代码，必须将模板放入S3存储桶。另外，您必须设置具有CloudFormation，S3和EC2权限的IAM角色。

以下代码成功创建了堆栈。

// snippet-start:[cf.java2.create_stack.import]
import software.amazon.awssdk.regions.Region;
import software.amazon.awssdk.services.cloudformation.CloudFormationClient;
import software.amazon.awssdk.services.cloudformation.model.CloudFormationException;
import software.amazon.awssdk.services.cloudformation.model.CreateStackRequest;
import software.amazon.awssdk.services.cloudformation.model.OnFailure;
import software.amazon.awssdk.services.cloudformation.model.CreateStackResponse;
import software.amazon.awssdk.services.cloudformation.model.Parameter;
// snippet-end:[cf.java2.create_stack.import]

/**
 *  To run this example, you must have a valid template that is located in a S3 bucket.
 *  For example:
 *
 *  https://s3.amazonaws.com/mybucket/CloudFormationTemplate.yml
 *
 *  Also, the role that you use must have CloudFormation permissions as well as S3 and EC2 permissions. For more information,
 *  see "Getting started with AWS CloudFormation" in the AWS CloudFormation User Guide.
 *
 */

public class CreateStack {

   public static void main(String[] args) {


        String stackName = "mystack2";
        String roleARN = "arn:aws:iam::<enter ARN Role>";
        String location = "https://s3.amazonaws.com/<BUCKET NAME>/CloudFormationTemplate.yml";

        Region region = Region.US_EAST_1;
        CloudFormationClient cfClient = CloudFormationClient.builder()
                .region(region)
                .build();

        try {
            
            // Ensure you set the correct key name and value
            Parameter myParameter = Parameter.builder()
                    .parameterKey("KeyName")
                    .parameterValue("keypair1")
                    .build();

            CreateStackRequest stackRequest = CreateStackRequest.builder()
                .stackName(stackName)
                .templateURL(location)
                .roleARN(roleARN)
                .onFailure(OnFailure.ROLLBACK)
                .parameters(myParameter)
                .build();

            CreateStackResponse stackResponse = cfClient.createStack(stackRequest);
            System.out.println("The stack Id value is " +stackResponse.stackId());

        } catch (CloudFormationException e) {
            System.err.println(e.getMessage());
            System.exit(1);
        }

    }
}

如何在AWS Java SDK中使用IAM角色创建云层？

1 个答案: