在CloudFormation中跨不同的AWS账户添加VPC对等路由

时间:2018-02-22 16:10:54

标签: amazon-web-services amazon-cloudformation amazon-vpc

使用此AWS walkthrough,我可以在不同的aws帐户之间成功添加vpc对等连接。

自动接受连接,因为在受理人帐户中设置了IAM角色,并在请求连接时在请求者帐户中引用该权限。

这一切都很好,但是在两个VPC中都没有路由表条目,这种连接毫无意义。

查看示例中的第二个模板;创建AWS::EC2::VPCPeeringConnection的那个,有没有办法在第一个模板中创建的VPC的路由表条目中添加路由?

我当然可以将路由表ID传递给第二个模板,但我不认为这就足够了。我认为在允许这种情况的帐户之间必须存在额外的信任关系。

关于如何做到这一点的任何想法?

3 个答案:

答案 0 :(得分:1)

我能够使用以下组合做到这一点:

1) In the accepter account
 -- added an SNS topic
 -- added a lambda function that uses boto3 to create the route entry.  It receives the peering connection id and CIDR and adds it to the route table of the accepter VPC
 -- added a permission to tirgger the lambda from the SNS topic
 -- updated the PeerRole to allow cross account access to sns:Publish on Arn of the topic
  -- added a topic policy to allow cross account publish on sns topic

2) On the requester account
  -- added a lambda that sends a message to the SNS topic with the VPC Peer Id, and the CIDR

它有点冗长,但这里是接受者模板的json的一部分

"AcceptVPCPeerLambdaExecutionRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "Path": "/",
                "Policies": [
                    {
                        "PolicyName": "CrossAccountVPCPeering",
                        "PolicyDocument": {
                            "Statement": [
                            {
                                "Action": [
                                    "logs:CreateLogGroup",
                                    "logs:CreateLogStream",
                                    "logs:GetLogEvents",
                                    "logs:PutLogEvents",
                                ],
                                "Resource": [ "arn:aws:logs:*:*:*" ],
                                "Effect": "Allow"
                            },
                            {
                                "Effect":"Allow",
                                "Action":["ec2:*Route*"],
                                "Resource":"*"
                            }
                        ]
                        }
                    }
                ],
                "AssumeRolePolicyDocument": {
                    "Statement": [
                    {
                        "Action": [ "sts:AssumeRole" ],
                        "Effect": "Allow",
                        "Principal": {
                          "Service": [ "lambda.amazonaws.com" ]
                        }
                    }]
                }
            }
        },
        "AcceptVPCPeerLambdaFunction": {
            "DependsOn": ["AcceptVPCPeerLambdaExecutionRole"],
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "ZipFile" : { "Fn::Join" : ["\n", [
                          "import json",
                          "import boto3",
                          "import logging",
                          "logger = logging.getLogger()",
                          "logger.setLevel(logging.INFO)",
                          "def handler(event, context):",
                          "    message = json.loads(event['Records'][0]['Sns']['Message'])",
                          "    #logger.info('got event {}'.format(event))",
                          "    logger.info('message {}'.format(message))",
                          "    client = boto3.client('ec2')",
                          "    response = client.create_route(",
                          "        DestinationCidrBlock=message.get('destCidrBlock'),",
                          "        VpcPeeringConnectionId=message.get('ReqVpcPeeringId'),",
                          {"Fn::Sub" : ["        RouteTableId='${RouteTableId}'", {"RouteTableId" : {"Ref" : "PrivateRouteTable"}}]},
                          "    )",
                          "    logger.info('response code is {} '.format(",
                          "       response['Return']",
                          "    ))",

                        ]]
                    }
                },
                "Description": "Accept A VPC Peering Connection From Requested By Another Account",
                "MemorySize": 128,
                "Handler": "index.handler",
                "Role": {
                    "Fn::GetAtt": [ "AcceptVPCPeerLambdaExecutionRole", "Arn" ]
                },
                "Timeout": 300,
                "Runtime": "python2.7"
            }
        },
        "AcceptVPCPeerSNSTopic": {
            "DependsOn": [ "AcceptVPCPeerLambdaFunction" ],
            "Type": "AWS::SNS::Topic",
            "Properties": {
                "Subscription": [{
                    "Endpoint": {"Fn::GetAtt": [ "AcceptVPCPeerLambdaFunction", "Arn" ]},
                    "Protocol": "lambda"
                }]
            }
        },
"SNSTopicPolicy" : {
            "Type" : "AWS::SNS::TopicPolicy",
            "Properties" :{
                "PolicyDocument" : {
                    "Version":"2012-10-17",
                    "Id":"AWSAccountTopicAccess",
                    "Statement" :[
                        {
                            "Sid":"allow-publish-vpc-peering",
                            "Effect":"Allow",           
                            "Principal" :{
                            "AWS": {"Ref": "PeerRequesterAccounts"}
                        },
                        "Action":["sns:Publish"],
                        "Resource" : "*"
                        }
                    ]
                },
                "Topics" : [ {"Ref" : "AcceptVPCPeerSNSTopic"}]
            }
        }

请求者模板的Lambda是

"VpcPeeringConnection": {
            "Type": "AWS::EC2::VPCPeeringConnection",
            "DependsOn" : ["VPC"],
            "Properties": {
                "VpcId": {
                    "Ref": "VPC"
                },
                "PeerVpcId": {
                    "Ref": "PeerVPCId"
                },
                "PeerOwnerId": {
                    "Ref": "PeerVPCAccountId"
                },
                "PeerRoleArn": {
                    "Ref": "PeerRoleArn"
                },
                "Tags" : [
                    {"Key" : "Name", "Value" : "DevOps Account To VPN Account"}
                ]
            }
        },
"RequesterVPCPeerLambdaFunction": {
            "DependsOn": ["RequesterVPCPeerLambdaExecutionRole", "VPC", "VpcPeeringConnection"],
            "Type": "AWS::Lambda::Function",
            "Properties": {
                "Code": {
                    "ZipFile" : { "Fn::Join" : ["\n", [
                          "import json",
                          "import boto3",
                          "import cfnresponse",
                          "def handler(event, context):",
                          "    message = {",
                          { "Fn::Sub": [ " 'ReqVpcPeeringId' : '${VpcPeeringId}',", { "VpcPeeringId": {"Ref" : "VpcPeeringConnection" }} ]},
                          { "Fn::Sub": [ " 'destCidrBlock' : '${destCidrBlock}'", { "destCidrBlock": {"Ref" : "TestPrivateSubnet1Cidr" }} ]},
                          "    }",
                          "    client = boto3.client('sns')",
                          "    response = client.publish(",
                          { "Fn::Sub": [ "        TargetArn='${TargetArn}',", { "TargetArn": {"Ref" : "AcceptVPCPeerSNSTopicArn" }} ]},
                          "        Message=json.dumps({'default': json.dumps(message)}),",
                          "        MessageStructure='json'",
                          "    )"
                        ]]
                    }
                },
                "Description": "Lambda Function To Publish the VPC Peering Connection Id to The VPN Accepter SNS Topic",
                "MemorySize": 128,
                "Handler": "index.handler",
                "Role": {
                    "Fn::GetAtt": [ "RequesterVPCPeerLambdaExecutionRole", "Arn" ]
                },
                "Timeout": 300,
                "Runtime": "python2.7"
            }
        }

答案 1 :(得分:0)

可以在第二个模板中的第一个VPC中创建路径表条目。您可能包含在第二个模板中的相关CloudFormation资源的示例:

Resources:
  IsolationVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.1.0.0/16"

  PrimaryPrivateSubnet:
    DependsOn:
      - IsolationVPC
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: IsolationVPC
      AvailabilityZone: ${self:provider.region}a
      CidrBlock: 10.1.1.0/24
  PrimaryPrivateSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: IsolationVPC
    DependsOn:
      - IsolationVPC

  PrimaryPublicSubnet:
    DependsOn:
      - IsolationVPC
    Type: AWS::EC2::Subnet
    Properties:
      VpcId:
        Ref: IsolationVPC
      AvailabilityZone: ${self:provider.region}a
      CidrBlock: 10.1.2.0/24
  PrimaryPublicSubnetRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: IsolationVPC
    DependsOn:
      - IsolationVPC

  PeeringConnection:
    Type: AWS::EC2::VPCPeeringConnection
    DependsOn:
      - IsolationVPC
    Properties: 
      PeerVpcId: <first VPC ID goes here>
      VpcId:
        Ref: IsolationVPC
  PublicRoutingTableEntry:
    Type: AWS::EC2::Route
    DependsOn:
      - PrimaryPublicSubnetRouteTable
      - PeeringConnection
    Properties:
      RouteTableId:
        Ref: PrimaryPublicSubnetRouteTable
      DestinationCidrBlock: <first VPC CIDR block goes here>
      VpcPeeringConnectionId:
        Ref: PeeringConnection
  PrivateRoutingTableEntry:
    Type: AWS::EC2::Route
    DependsOn:
      - PrimaryPrivateSubnetRouteTable
      - PeeringConnection
    Properties:
      RouteTableId:
        Ref: PrimaryPrivateSubnetRouteTable
      DestinationCidrBlock: <first VPC CIDR block goes here>
      VpcPeeringConnectionId:
        Ref: PeeringConnection
  ReversePublicRoutingTableEntry:
    Type: AWS::EC2::Route
    DependsOn:
      - PeeringConnection
    Properties:
      RouteTableId: <first VPC public route table ID goes here>
      DestinationCidrBlock: 10.1.0.0/16
      VpcPeeringConnectionId:
        Ref: PeeringConnection
  ReversePrivateRoutingTableEntry:
    Type: AWS::EC2::Route
    DependsOn:
      - PeeringConnection
    Properties:
      RouteTableId: <first VPC private route table ID goes here>
      DestinationCidrBlock: 10.1.0.0/16
      VpcPeeringConnectionId:
        Ref: PeeringConnection

在我阅读此处提供的示例之前,我没有意识到这一点:https://github.com/lizduke/cloudformationexamples但是已经成功测试了它。

答案 2 :(得分:0)

为后代,我们一直使用this在VPC之间创建对等。

它使用我们的generic自定义资源提供程序来创建远程对等路由和标签,并有选择地授权进入远程安全组(例如):

  RemotePeeringRoute:
    Type: 'Custom::CreatePeeringRoute'
    Version: 1.0
    DependsOn: PeeringConnection
    Properties:
      ServiceToken: !Sub 'arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:generic-custom-resource-provider'
      RoleArn: !Sub 'arn:${AWS::Partition}:iam::${TargetAccountId}:role/VPCPeeringRole'
      AgentService: ec2
      AgentType: client
      AgentRegion: !Sub '${TargetRegion}'
      AgentCreateMethod: create_route
      AgentDeleteMethod: delete_route
      AgentCreateArgs:
        DestinationCidrBlock: !Sub '${RequesterCidrBlock.CidrBlock}'
        RouteTableId: !Select [ 0, !Split [ ',', !Ref 'TargetRouteTableIds' ]]
        VpcPeeringConnectionId: !Sub '${PeeringConnection}'
      AgentDeleteArgs:
        DestinationCidrBlock: !Sub '${RequesterCidrBlock.CidrBlock}'
        RouteTableId: !Select [ 0, !Split [ ',', !Ref 'TargetRouteTableIds' ]]

可以独立放置,也可以嵌套在另一个堆栈中。