amazon-web-services - 创建基于条件 block 的资源，该资源从 cloudformation 中的自定义资源获取输出？

Question

我有条件地根据从自定义资源获取输出的条件(即True 或False)创建S3Bucket。我的堆栈模板如下所示

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "BucketName": {
      "Type": "String",
      "Description": "Name of the Bucket."
    }
  },
  "Conditions" : {
    "BucketExistsOutput" : {"Fn::Equals" : [{ "Fn::GetAtt" : [ "BucketExists", "Output" ]}, "False"]}
  },
  "Resources": {
  "S3BucketARN": {
      "Type" : "AWS::S3::Bucket",
      "Condition" : "BucketExistsOutput",
      "Properties" : {
         "BucketName" : { "Ref" : "BucketName" }
         }
       },
    "DeploymentLambdaRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": [
                  "lambda.amazonaws.com"
                ]
              },
              "Action": [
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path": "/",
        "Policies": [
          {
            "PolicyName": "PermissionsToLogsAndS3",
            "PolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:CreateLogGroup",
                    "logs:CreateLogStream",
                    "logs:PutLogEvents",
                    "logs:DescribeLogStreams"
                  ],
                  "Resource": [
                    "arn:aws:logs:*:*:*"
                  ]
                },
                {
                  "Effect": "Allow",
                  "Action": [
                    "s3:*"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }
          }
        ]
      }
    },
    "DeploymentLambda": {
      "Type": "AWS::Lambda::Function",
      "Properties": {
        "Role": {
          "Fn::GetAtt": [
            "DeploymentLambdaRole",
            "Arn"
          ]
        },
        "Handler": "bucketexists.handler",
        "Runtime": "nodejs4.3",
        "Code": {
          "S3Bucket": "xxxx-xx",
          "S3Key": "bucketcondition.zip"
        }
      }
    },
    "BucketExists": {
      "Type": "Custom::BucketExists",
      "Properties": {
        "ServiceToken": {
          "Fn::GetAtt": [
            "DeploymentLambda",
            "Arn"
          ]
        },
        "Bucket": {
          "Ref": "BucketName"
        }
      }
    }
  },
 "Outputs" : {
  "BucketExistsValue" : {
    "Description": "The Value of custom bucket lambda",  
    "Value" : { "Fn::GetAtt" : [ "BucketExists", "Output" ]} 
  }
}
} 

这会抛出这样的错误

Template is not valid: Template format error: Unresolved dependencies [BucketExists]. Cannot reference resources in the Conditions block of the template

这表示我无法指向条件 block 中的资源。

我怎样才能解决这种情况？他们有解决方法吗？

谢谢感谢任何帮助

Answer 1

我可以通过将上面的堆栈分成两部分来解决我的问题

<强>1。自定义 lambda 堆栈

{
      "AWSTemplateFormatVersion": "2010-09-09",
      "Parameters": {
        "ProjectId": {
          "Type": "String",
          "Description": "Name of the ProjectId."
        },
         "BucketName": {
          "Type": "String",
          "Description": "Name of the BucketName."
        }
      },
      "Resources": {
        "DeploymentLambdaRole": {
          "Type": "AWS::IAM::Role",
          "Properties": {
            "AssumeRolePolicyDocument": {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Principal": {
                    "Service": [
                      "lambda.amazonaws.com"
                    ]
                  },
                  "Action": [
                    "sts:AssumeRole"
                  ]
                }
              ]
            },
            "Path": "/",
            "Policies": [
              {
                "PolicyName": "PermissionsToLogsAndS3",
                "PolicyDocument": {
                  "Version": "2012-10-17",
                  "Statement": [
                    {
                      "Effect": "Allow",
                      "Action": [
                        "logs:CreateLogGroup",
                        "logs:CreateLogStream",
                        "logs:PutLogEvents",
                        "logs:DescribeLogStreams"
                      ],
                      "Resource": [
                        "arn:aws:logs:*:*:*"
                      ]
                    },
                    {
                      "Effect": "Allow",
                      "Action": [
                        "s3:*"
                      ],
                      "Resource": [
                        "*"
                      ]
                    }
                  ]
                }
              }
            ]
          }
        },
        "DeploymentLambda": {
          "Type": "AWS::Lambda::Function",
          "Properties": {
            "Role": {
              "Fn::GetAtt": [
                "DeploymentLambdaRole",
                "Arn"
              ]
            },
            "Handler": "bucketexists.handler",
            "Runtime": "nodejs4.3",
            "Code": {
              "S3Bucket": "xxxxxxxx",
              "S3Key": "bucketcondition.zip"
            }
          }
        },
        "BucketExists": {
          "Type": "Custom::BucketExists",
          "Properties": {
            "ServiceToken": {
              "Fn::GetAtt": [
                "DeploymentLambda",
                "Arn"
              ]
            },
            "Bucket": {
              "Ref": "BucketName"
            }
          }
        }
      },
     "Outputs" : {
      "BucketExistsValue" : {
        "Description": "The Value of custom bucket lambda",  
        "Value" : { "Fn::GetAtt" : [ "BucketExists", "Output" ]}    
      }
    }
    }

<强>2。 S3 存储桶堆栈

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Parameters": {
    "BucketExistsValue": {
      "Type": "String",
      "Description": "Return value of the Bucket."
    },
     "ProjectId": {
      "Type": "String",
      "Description": "Name of the Project."
    }
  },
  "Conditions" : {
    "BucketExistsOutput" : {"Fn::Equals" : [{ "Ref" :"BucketExistsValue" }, "False"]}
  },
  "Resources": {
  "S3BucketARN": {
      "Type" : "AWS::S3::Bucket",
      "Condition" : "BucketExistsOutput",
      "Properties" : {
         "BucketName" : {  "Fn::Join": [
                            "-",
                            [
                                "testpika",
                                {
                                    "Ref": "ProjectId"
                                },
                                {
                                    "Ref": "AWS::Region"
                                }
                            ]
                        ] }
         }
       }
  }
}

使用 Codepipeline，我在部署阶段 1 中创建了两个操作，然后是 2(即 1 -> 2)。在第一个堆栈中，我将把自定义 lambda 的输出作为键值对存储在输出工件中，在第二个堆栈中，我将使用输出工件通过 Parameter Overrides 将自定义 lambda 键值对作为输入参数传递。 。

谢谢