Question

我正在尝试创建一个CloudWatch规则，该规则可按计划触发并执行状态机（Step Functions）。我正在使用CloudFormation来创建它，并且除了规则使用的IAM角色与规则本身的关联之外，其他所有东西都可以正常创建。这就是我的意思：

“使用现有角色”下的通知为空白。

此处是处理规则及其角色的CF模板部分。

"SFInvoke":{
    "Type": "AWS::IAM::Role",
    "Properties": {
      "AssumeRolePolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Service": {
                "Fn::Sub": "states.${AWS::Region}.amazonaws.com"
              }
            },
            "Action": "sts:AssumeRole"
          }
        ]
      },
      "Policies": [
        {
          "PolicyName": "StepFunctionsInvoke",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "states:StartExecution"
                ],
                "Resource": { "Ref" : "StateMachine"}
              }
            ]
          }
        }
      ]
    }
  },
  "CloudWatchStateMachineSDCEventRule": {
    "Type":"AWS::Events::Rule",
    "Properties": {
      "Description":"CloudWatch trigger for the InSite Static Data Consumer",
      "ScheduleExpression": "rate(5 minutes)",
      "State":"ENABLED",
      "Targets":[{
        "Arn":{ "Ref" : "StateMachine"},
        "Id":"StateMachineTargetId",
        "RoleArn":{
          "Fn::GetAtt": [
            "SFInvoke",
            "Arn"
          ]
        }
      }]
    }
},

Answer 1

您想让SFInvoke角色出现在Use existing role selector上吗？

在这种情况下，您需要将主体设置为events，而不是states。

您正在编辑上面的屏幕快照中的事件目标，而不是步进功能。委托人定义了可以充当角色的服务，在您的情况下就是事件服务。

尝试此操作以创建角色：

"SFInvoke":{
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": "events.amazonaws.com"
          },
          "Action": "sts:AssumeRole"
        }
      ]
    },
    "Policies": [
      {
        "PolicyName": "StepFunctionsInvoke",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "states:StartExecution"
              ],
              "Resource": { "Ref" : "StateMachine"}
            }
          ]
        }
      }
    ]
  }
}

Answer 2

Yaml可能是这样的：
基于主体：作为基于事件的服务和动作：开始执行StepFunctions状态机。

AWSEventsInvokeStepFunctions:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:  
              Service: 
                - events.amazonaws.com                   
            Action: sts:AssumeRole     
      Policies:
        - PolicyName: AWSEventsInvokeStepFunctions
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - states:StartExecution
                Resource: !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:*"

现在可以将本质上通用的角色应用于CloudWatch Event Rule，从而为Rule提供权限，使其能够基于Amazon S3事件启动执行StepFunctions状态机。

AmazonCloudWatchEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.s3
        detail-type:
          - 'AWS API Call via CloudTrail'
        detail:
          eventSource:
            - s3.amazonaws.com
          eventName:           
            - PutObject            
          requestParameters:
            bucketName:
              - !Ref EventBucket
      Targets:
        - 
          RoleArn: !GetAtt AWSEventsInvokeStepFunctions.Arn
          Arn: !Sub "arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:MyStateMachine"        
          Id: !Sub "StepExecution"

您可能可以在Start the Execution of State Machine based on Amazon S3 Event上查看更多信息

使用未链接到角色的AWS CloudFormation创建CloudWatch规则

2 个答案: