使用此AWS walkthrough，我可以在不同的aws帐户之间成功添加vpc对等连接。
自动接受连接，因为在受理人帐户中设置了IAM角色，并在请求连接时在请求者帐户中引用该权限。
这一切都很好，但是在两个VPC中都没有路由表条目，这种连接毫无意义。
查看示例中的第二个模板;创建AWS::EC2::VPCPeeringConnection的那个，有没有办法在第一个模板中创建的VPC的路由表条目中添加路由？
我当然可以将路由表ID传递给第二个模板，但我不认为这就足够了。我认为在允许这种情况的帐户之间必须存在额外的信任关系。
关于如何做到这一点的任何想法？
答案 0 :(得分：1)
我能够使用以下组合做到这一点：
1) In the accepter account
-- added an SNS topic
-- added a lambda function that uses boto3 to create the route entry. It receives the peering connection id and CIDR and adds it to the route table of the accepter VPC
-- added a permission to tirgger the lambda from the SNS topic
-- updated the PeerRole to allow cross account access to sns:Publish on Arn of the topic
-- added a topic policy to allow cross account publish on sns topic
2) On the requester account
-- added a lambda that sends a message to the SNS topic with the VPC Peer Id, and the CIDR
它有点冗长，但这里是接受者模板的json的一部分
"AcceptVPCPeerLambdaExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"Path": "/",
"Policies": [
{
"PolicyName": "CrossAccountVPCPeering",
"PolicyDocument": {
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:GetLogEvents",
"logs:PutLogEvents",
],
"Resource": [ "arn:aws:logs:*:*:*" ],
"Effect": "Allow"
},
{
"Effect":"Allow",
"Action":["ec2:*Route*"],
"Resource":"*"
}
]
}
}
],
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": [ "sts:AssumeRole" ],
"Effect": "Allow",
"Principal": {
"Service": [ "lambda.amazonaws.com" ]
}
}]
}
}
},
"AcceptVPCPeerLambdaFunction": {
"DependsOn": ["AcceptVPCPeerLambdaExecutionRole"],
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"ZipFile" : { "Fn::Join" : ["\n", [
"import json",
"import boto3",
"import logging",
"logger = logging.getLogger()",
"logger.setLevel(logging.INFO)",
"def handler(event, context):",
" message = json.loads(event['Records'][0]['Sns']['Message'])",
" #logger.info('got event {}'.format(event))",
" logger.info('message {}'.format(message))",
" client = boto3.client('ec2')",
" response = client.create_route(",
" DestinationCidrBlock=message.get('destCidrBlock'),",
" VpcPeeringConnectionId=message.get('ReqVpcPeeringId'),",
{"Fn::Sub" : [" RouteTableId='${RouteTableId}'", {"RouteTableId" : {"Ref" : "PrivateRouteTable"}}]},
" )",
" logger.info('response code is {} '.format(",
" response['Return']",
" ))",
]]
}
},
"Description": "Accept A VPC Peering Connection From Requested By Another Account",
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [ "AcceptVPCPeerLambdaExecutionRole", "Arn" ]
},
"Timeout": 300,
"Runtime": "python2.7"
}
},
"AcceptVPCPeerSNSTopic": {
"DependsOn": [ "AcceptVPCPeerLambdaFunction" ],
"Type": "AWS::SNS::Topic",
"Properties": {
"Subscription": [{
"Endpoint": {"Fn::GetAtt": [ "AcceptVPCPeerLambdaFunction", "Arn" ]},
"Protocol": "lambda"
}]
}
},
"SNSTopicPolicy" : {
"Type" : "AWS::SNS::TopicPolicy",
"Properties" :{
"PolicyDocument" : {
"Version":"2012-10-17",
"Id":"AWSAccountTopicAccess",
"Statement" :[
{
"Sid":"allow-publish-vpc-peering",
"Effect":"Allow",
"Principal" :{
"AWS": {"Ref": "PeerRequesterAccounts"}
},
"Action":["sns:Publish"],
"Resource" : "*"
}
]
},
"Topics" : [ {"Ref" : "AcceptVPCPeerSNSTopic"}]
}
}
请求者模板的Lambda是
"VpcPeeringConnection": {
"Type": "AWS::EC2::VPCPeeringConnection",
"DependsOn" : ["VPC"],
"Properties": {
"VpcId": {
"Ref": "VPC"
},
"PeerVpcId": {
"Ref": "PeerVPCId"
},
"PeerOwnerId": {
"Ref": "PeerVPCAccountId"
},
"PeerRoleArn": {
"Ref": "PeerRoleArn"
},
"Tags" : [
{"Key" : "Name", "Value" : "DevOps Account To VPN Account"}
]
}
},
"RequesterVPCPeerLambdaFunction": {
"DependsOn": ["RequesterVPCPeerLambdaExecutionRole", "VPC", "VpcPeeringConnection"],
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"ZipFile" : { "Fn::Join" : ["\n", [
"import json",
"import boto3",
"import cfnresponse",
"def handler(event, context):",
" message = {",
{ "Fn::Sub": [ " 'ReqVpcPeeringId' : '${VpcPeeringId}',", { "VpcPeeringId": {"Ref" : "VpcPeeringConnection" }} ]},
{ "Fn::Sub": [ " 'destCidrBlock' : '${destCidrBlock}'", { "destCidrBlock": {"Ref" : "TestPrivateSubnet1Cidr" }} ]},
" }",
" client = boto3.client('sns')",
" response = client.publish(",
{ "Fn::Sub": [ " TargetArn='${TargetArn}',", { "TargetArn": {"Ref" : "AcceptVPCPeerSNSTopicArn" }} ]},
" Message=json.dumps({'default': json.dumps(message)}),",
" MessageStructure='json'",
" )"
]]
}
},
"Description": "Lambda Function To Publish the VPC Peering Connection Id to The VPN Accepter SNS Topic",
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [ "RequesterVPCPeerLambdaExecutionRole", "Arn" ]
},
"Timeout": 300,
"Runtime": "python2.7"
}
}
答案 1 :(得分：0)
可以在第二个模板中的第一个VPC中创建路径表条目。您可能包含在第二个模板中的相关CloudFormation资源的示例：
Resources:
IsolationVPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: "10.1.0.0/16"
PrimaryPrivateSubnet:
DependsOn:
- IsolationVPC
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: IsolationVPC
AvailabilityZone: ${self:provider.region}a
CidrBlock: 10.1.1.0/24
PrimaryPrivateSubnetRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: IsolationVPC
DependsOn:
- IsolationVPC
PrimaryPublicSubnet:
DependsOn:
- IsolationVPC
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: IsolationVPC
AvailabilityZone: ${self:provider.region}a
CidrBlock: 10.1.2.0/24
PrimaryPublicSubnetRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: IsolationVPC
DependsOn:
- IsolationVPC
PeeringConnection:
Type: AWS::EC2::VPCPeeringConnection
DependsOn:
- IsolationVPC
Properties:
PeerVpcId: <first VPC ID goes here>
VpcId:
Ref: IsolationVPC
PublicRoutingTableEntry:
Type: AWS::EC2::Route
DependsOn:
- PrimaryPublicSubnetRouteTable
- PeeringConnection
Properties:
RouteTableId:
Ref: PrimaryPublicSubnetRouteTable
DestinationCidrBlock: <first VPC CIDR block goes here>
VpcPeeringConnectionId:
Ref: PeeringConnection
PrivateRoutingTableEntry:
Type: AWS::EC2::Route
DependsOn:
- PrimaryPrivateSubnetRouteTable
- PeeringConnection
Properties:
RouteTableId:
Ref: PrimaryPrivateSubnetRouteTable
DestinationCidrBlock: <first VPC CIDR block goes here>
VpcPeeringConnectionId:
Ref: PeeringConnection
ReversePublicRoutingTableEntry:
Type: AWS::EC2::Route
DependsOn:
- PeeringConnection
Properties:
RouteTableId: <first VPC public route table ID goes here>
DestinationCidrBlock: 10.1.0.0/16
VpcPeeringConnectionId:
Ref: PeeringConnection
ReversePrivateRoutingTableEntry:
Type: AWS::EC2::Route
DependsOn:
- PeeringConnection
Properties:
RouteTableId: <first VPC private route table ID goes here>
DestinationCidrBlock: 10.1.0.0/16
VpcPeeringConnectionId:
Ref: PeeringConnection
在我阅读此处提供的示例之前，我没有意识到这一点：https://github.com/lizduke/cloudformationexamples但是已经成功测试了它。
答案 2 :(得分：0)
为后代，我们一直使用this在VPC之间创建对等。
它使用我们的generic自定义资源提供程序来创建远程对等路由和标签，并有选择地授权进入远程安全组（例如）：
RemotePeeringRoute:
Type: 'Custom::CreatePeeringRoute'
Version: 1.0
DependsOn: PeeringConnection
Properties:
ServiceToken: !Sub 'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:generic-custom-resource-provider'
RoleArn: !Sub 'arn:${AWS::Partition}:iam::${TargetAccountId}:role/VPCPeeringRole'
AgentService: ec2
AgentType: client
AgentRegion: !Sub '${TargetRegion}'
AgentCreateMethod: create_route
AgentDeleteMethod: delete_route
AgentCreateArgs:
DestinationCidrBlock: !Sub '${RequesterCidrBlock.CidrBlock}'
RouteTableId: !Select [ 0, !Split [ ',', !Ref 'TargetRouteTableIds' ]]
VpcPeeringConnectionId: !Sub '${PeeringConnection}'
AgentDeleteArgs:
DestinationCidrBlock: !Sub '${RequesterCidrBlock.CidrBlock}'
RouteTableId: !Select [ 0, !Split [ ',', !Ref 'TargetRouteTableIds' ]]
可以独立放置，也可以嵌套在另一个堆栈中。