Question

我正在尝试在CFT中进行多行替换，但这只是没有发生。我收到的错误是

An error occurred (ValidationError) when calling the ValidateTemplate operation: Template format error: unsupported structure.

这是非常难以描述的。我有用于intellij的CFT插件，它没有给我任何语法错误。支持这样的事情吗？问题行位于Fn::Sub

根据this documentation。

这是我正在使用的示例。我让整个CFT都使用硬编码值，但我希望它与从CFT导入的值一起使用，从而创建了我要观察的堆栈部分

代码：

AWSTemplateFormatVersion: 2010-09-09
Description: "Per ticket: CLOUD-1284"
Parameters:
  LogGroupName:
    Type: String
    Default: "ct/dev-logs"
    AllowedValues: ["ct/dev-logs","ct/prod-logs"]
    Description: Enter CloudWatch Logs log group name. Default is ct/dev-logs

  Email:
    Type: String
    Description: Email address to notify when an API activity has triggered an alarm
    Default: cloudops@
Resources:
  PolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern:
        Fn::Sub:
        - >-
        { ($.eventSource = iam.amazonaws.com) &&
          (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
          (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
        - Ec2Role: !ImportValue infra-Ec2IamRole
        - RdsRole: !ImportValue infra-RdsIamRole

      LogGroupName: !Ref LogGroupName
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: PolicyUpdateMetrics

  PolicyUpdatesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: " Policies have have been updated"
      AlarmActions:
      - Ref: AlarmNotificationTopic
      MetricName: PolicyUpdateMetrics
      Namespace: SpecialMetrics
      Statistic: Sum
      Period: 10
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  S3BucketPolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: >-
        { ($.eventSource = s3.amazonaws.com) && (($.eventName = Put*) || ($.eventName = Delete*)) &&
        (($.requestParameters.bucketName = assets-us-east-1) || ($.requestParameters.bucketName = logs-us-east-1)) }
      LogGroupName: !Ref LogGroupName
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: S3BucketPolicyUpdateMetric

  S3BucketPolicyUpdatesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: " S3 bucket security settings have been updated"
      AlarmActions:
      - Ref: AlarmNotificationTopic
      MetricName: S3BucketPolicyUpdateMetric
      Namespace: SpecialMetrics
      Statistic: Sum
      Period: 10
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  AlarmNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
      - Endpoint: !Ref Email
        Protocol: email

Answer 1

是的，但是您只需要修复语法。

修复：

这是代码的简化版本，显示了已更正的语法：

---
AWSTemplateFormatVersion: 2010-09-09
Description: Test Stack
Resources:
  PolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern:
        Fn::Sub:
        - >-
          { ($.eventSource = iam.amazonaws.com) &&
          (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
          (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
        - {Ec2Role: MyEc2Role, RdsRole: MyRdsRole}
      LogGroupName: !Ref LogGroup
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: PolicyUpdateMetrics

  LogGroup:
    Type: AWS::Logs::LogGroup

在创建该堆栈时，将创建以下指标筛选器：

▶ aws logs describe-metric-filters --query 'metricFilters[].filterPattern' 
[
    "{ ($.eventSource = iam.amazonaws.com) && (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) && (($.requestParameters.roleName = MyEc2Role) || ($.requestParameters.roleName = MyRdsRole)) }"
]

因此，您需要将Fn::Sub更改为：

FilterPattern:
  Fn::Sub:
    - >-
      { ($.eventSource = iam.amazonaws.com) &&
        (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
        (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
    - {Ec2Role: !ImportValue infra-Ec2IamRole, RdsRole: !ImportValue infra-RdsIamRole}

如何获取更好的错误消息：

我做的第一件事是运行cloudformation validate-template：

▶ aws cloudformation validate-template --template-body file://cloudformation.yml

An error occurred (ValidationError) when calling the ValidateTemplate operation:
  Template format error: YAML not well-formed. (line 23, column 45)

由于这是YAML格式问题，因此yamllint实用程序通常会提供更多信息：

▶ yamllint cloudformation.yml 
cloudformation.yml
  23:45     error    syntax error: could not find expected ':'

进入vim编辑器并发出命令：

:cal cursor(23,45)

将我带到第23行第45列，在其中找到字符串${Ec2Role}的开头。

我看到的第一个问题是缩进是错误的。这实际上是该消息的原因。

通过将第21-23行缩进2个空格，可使模板成为有效的YAML。然后我从cloudformation validate-template得到了一个更有用的答复：

▶ aws cloudformation validate-template --template-body file://cloudformation.yml 

An error occurred (ValidationError) when calling the ValidateTemplate operation:
  Template error: One or more Fn::Sub intrinsic functions don't specify expected
  arguments. Specify a string as first argument, and an optional second argument
  to specify a mapping of values to replace in the string

这时，从文档中可以看出，对Fn::Sub的调用在语法上是错误的。

YAML中的CloudFormation多行替代。可能吗？

1 个答案: