gpt4 book ai didi

amazon-web-services - 如何使用 Terraform 定义 cloundwatch 事件规则来触发 StepFunction statemachine

转载 作者:行者123 更新时间:2023-12-02 19:00:59 26 4
gpt4 key购买 nike

我已经在 Terraform 中定义了一个 StepFunction 状态机的创建,现在我想设置一个定时器来每天触发状态机,我认为使用 cloudwatch 事件规则可能是一个不错的选择,我知道如何将事件规则设置为触发 Lambda:

resource "aws_cloudwatch_event_rule" "lambda_event_rule" {
name = xxx
schedule_expression = xxx
description = xxx
}

resource "aws_cloudwatch_event_target" "lambda_event_target" {
target_id = xxx
rule = aws_cloudwatch_event_rule.lambda_event_rule.name
arn = xxx
}

#I must setup the right permissions using 'aws_lambda_permission'
#see: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target

resource "aws_lambda_permission" "lambda_event_permission" {
statement_id = xxx
action = "lambda:InvokeFunction"
function_name = xxx
principal = "events.amazonaws.com"
source_arn = aws_cloudwatch_event_rule.lambda_event_rule.name
}

但是我如何设置触发状态机的权限部分?我找不到任何关于它的例子,我错过了什么吗?是因为我们不需要状态机的权限配置吗?有人可以帮忙吗?

以下是到目前为止我使用 cloudwatch 事件规则触发状态机的结果:

resource "aws_cloudwatch_event_rule" "step_function_event_rule" {
name = xxx
schedule_expression = xxx
description = xxx
}

resource "aws_cloudwatch_event_target" "step_function_event_target" {
target_id = xxx
rule = aws_cloudwatch_event_rule.step_function_event_rule.name
arn = xxx
}


?????What else should I add here?

PS:我发现有人在问类似的问题here , 但还没有答案。

最佳答案

    resource "aws_lambda_permission" "lambda_event_permission" {
statement_id = xxx
action = "lambda:InvokeFunction"
function_name = xxx
principal = "events.amazonaws.com"
source_arn = aws_cloudwatch_event_rule.lambda_event_rule.name
}

部分在您的情况下根本不需要,仅按照“为了能够让 EventBridge 规则调用您的 AWS Lambda 函数或 SNS 主题”所述才需要。

正如 blr 在他的回答中所述,您需要在 aws_cloudwatch_event_target 中添加 role_arn,设置一个具有 assume_role_policy 的角色,该角色授予访问权限到 states.amazonaws.com 和 events.amazonaws.com,并为这个角色附加一个额外的政策,如下所示:

    data "aws_iam_policy_document" "CW2SF_allowexec" {
statement {
actions = [
"sts:AssumeRole"
]

principals {
type = "Service"
identifiers = [
"states.amazonaws.com",
"events.amazonaws.com"
]
}
}
}

resource "aws_iam_role" "CW2SF_allowexec" {
name = "AWS_Events_Invoke-StepFunc"
assume_role_policy = data.aws_iam_policy_document.CW2SF_allowexec.json
}

resource "aws_iam_role_policy" "state-execution" {
name = "CW2SF_allowexec"
role = aws_iam_role.CW2SF_allowexec.id

policy = <<EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"states:StartExecution"
],
"Resource": [
"arn:aws:states:${var.region}:${data.aws_caller_identity.current.account_id}:stateMachine:data-pipeline-incremental"
]
}
]
}
EOF
}

您需要使用 AssumeRole 在 CloudWatch 和 StepFunctions 之间建立信任,然后将内联或托管策略附加到角色,专门允许此角色启动状态机的 StartExecution。

关于amazon-web-services - 如何使用 Terraform 定义 cloundwatch 事件规则来触发 StepFunction statemachine,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/65580652/

26 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com