Question

我创建了一个CloudFormation堆栈集，该集将AWS Config规则部署到了两个账户。现在，我想创建一个部署补救措施的堆栈集。当我将所有内容都放在一个CFT中时，代码的底行就起作用了。但我想先在一个脚本中部署检测规则，然后再在补救规则中部署。如何从其他scipt引用S3BucketEncryptionEnabled资源？

---------------------Detection --------------------------------------------------------
 S3BucketEncryptionEnabled:
    Type:  AWS::Config::ConfigRule
    Properties:
      Description: Checks that your Amazon S3 bucket either has S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption.
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket
    DependsOn: ConfigRecorder

----------------------Remediation Script-----------------------------------------------
BasicRemediationConfiguration:
    Type: "AWS::Config::RemediationConfiguration"
    Properties:
        Automatic: True
        MaximumAutomaticAttempts: 5
        RetryAttemptSeconds: 60
        ConfigRuleName: !Ref S3BucketEncryptionEnabled
        Parameters:
            AutomationAssumeRole:
                StaticValue:
                    Values: [{"Fn::GetAtt" : ["S3Role","Arn"]}]       
                    
            BucketName:
                ResourceValue:
                    Value: RESOURCE_ID


            SSEAlgorithm:
                StaticValue:
                    Values: [AES256]
        TargetId: "AWS-EnableS3BucketEncryption"
        TargetType: "SSM_DOCUMENT"
        TargetVersion: "1"

Answer 1

通常，在您的Detection模板中，您将在输出中export S3BucketEncryptionEnabled。

例如：

Outputs:

    S3BucketEncryptionEnabled:
        Value: !Ref S3BucketEncryptionEnabled
        Export:
            Name: MyS3BucketEncryptionEnabled

然后在您的Remediation模板中，将使用ImportValue导入导出的值。

例如：

BasicRemediationConfiguration:
    Type: "AWS::Config::RemediationConfiguration"
    Properties:
        Automatic: True
        MaximumAutomaticAttempts: 5
        RetryAttemptSeconds: 60
        ConfigRuleName: !ImportValue MyS3BucketEncryptionEnabled
        # remaining properties

如何导出资源名称并在不同的Cloudformation Stackset中使用？

1 个答案: