Question

我正在尝试将供应商提供的CloudFormation堆栈转换为Terraform。有AWS::CloudFormation::CustomResource用于发送SNS通知：

...
"RegistrationNotification": {
  "Type": "AWS::CloudFormation::CustomResource",
  "Version": "1.0",
  "Properties": {
    "ServiceToken": {"Ref" : "SnsTopicRegistration"},
    "Version": "1.0",
    "AccountID": {
      "Ref": "AWS::AccountId"
    },
    "CloudTrailCreated": {
      "Ref": "EnableNewCloudTrail"
    },
    "IamRoleARN": {
      "Fn::GetAtt": [
        "iamRole",
        "Arn"
      ]
    }
  }
}
...

我的计划是为aws sns publish提供本地执行资源。但是，CustomResource属性是作为消息属性发送的还是在消息正文中发送的？

到目前为止，这是我尝试过的方法，但是我不认为它能起作用。

message.txt:
{
  "AccountID":"111111111111",
  "CloudTrailCreated":"false",
  "IAMRoleArn":"arn:aws:iam::111111111111:role/TestRole"
}

aws sns publish --target-arn "arn:aws:sns:us-west-2:123456789012:test-topic" --message file://message.txt

Answer 1

设置了自己的 SNS-> SQS 管道并覆盖了供应商的SNS目标之后，我能够看到CloudFormation生成的完整消息：

message.txt: 
{
  "RequestType":"Create",
  "ServiceToken":"arn:aws:sns:us-east-1:999999999999:registration",
  "ResponseURL":"https://custom-resource-response-useast1.s3-us-east-1.amazonaws.com/arn%3Aaws%3Acloudformation%3Aus-east-1%3A111111111111%3Astack/Vendor_App/f16ba060-f981-11e8%7CRegistrationNotification%7C754d1dbc-2cc9-4b5f-855a?AWSAccessKeyId=AKIAIBLSGNTMEXAMPLE&Expires=1544126938&Signature=UohvGFPBHWrCz%2BMxgVKHF1L%2FNe4%3D",
  "StackId":"arn:aws:cloudformation:us-east-1:111111111111:stack/Vendor_App/f16ba060-f981-11e8-9ecc",
  "RequestId":"754d1dbc-2cc9-4b5f-855a",
  "LogicalResourceId":"RegistrationNotification",
  "ResourceType":"AWS::CloudFormation::CustomResource",
  "ResourceProperties":{
    "ServiceToken":"arn:aws:sns:us-east-1:999999999999:cs-cloudconnect-manager-registration",
    "AccountID":"111111111111",
    "Version":"1.0",
    "IamRoleARN":"arn:aws:iam::111111111111:role/TestRole",
    "CloudTrailCreated":"false"
  }
}

AWS CloudFormation Custom Resource Request Objects文档有助于了解哪些字段是必填字段。

最终，我使用本地执行程序资源的计划失败了，我诉诸于从Terraform调用CloudFormation堆栈：

resource "aws_cloudformation_stack" "vendor-stack" {
  name = "Vendor-App-Stack"
  capabilities = [ "CAPABILITY_NAMED_IAM" ]
  parameters {
    RoleName="TestRole"
    EnableNewCloudTrail="false"
  }
  template_url = "https://s3.amazonaws.com/vendor-prod-templates/aws_cloudformation_v1.0.json"
}

将CloudFormation自定义SNS资源转换为AWS CLI

1 个答案: