amazon-web-services - 如何导出资源名称并在不同的 Cloudformation Stackset 中使用？

Question

我创建了一个 CloudFormation Stackset，将 AWS Config 规则部署到两个账户。现在我想创建一个部署修复的堆栈集。当我将所有代码都放在一个 CFT 中时，最底层的代码就可以工作了。但我想首先在一个脚本中部署检测规则，然后再部署修复规则。如何从不同的脚本引用 S3BucketEncryptionEnabled 资源？

---------------------Detection --------------------------------------------------------
 S3BucketEncryptionEnabled:
    Type:  AWS::Config::ConfigRule
    Properties:
      Description: Checks that your Amazon S3 bucket either has S3 default encryption enabled or that the S3 bucket policy explicitly denies put-object requests without server side encryption.
      Source:
        Owner: AWS
        SourceIdentifier: S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED
      Scope:
        ComplianceResourceTypes:
          - AWS::S3::Bucket
    DependsOn: ConfigRecorder

----------------------Remediation Script-----------------------------------------------
BasicRemediationConfiguration:
    Type: "AWS::Config::RemediationConfiguration"
    Properties:
        Automatic: True
        MaximumAutomaticAttempts: 5
        RetryAttemptSeconds: 60
        ConfigRuleName: !Ref S3BucketEncryptionEnabled
        Parameters:
            AutomationAssumeRole:
                StaticValue:
                    Values: [{"Fn::GetAtt" : ["S3Role","Arn"]}]       
                    
            BucketName:
                ResourceValue:
                    Value: RESOURCE_ID


            SSEAlgorithm:
                StaticValue:
                    Values: [AES256]
        TargetId: "AWS-EnableS3BucketEncryption"
        TargetType: "SSM_DOCUMENT"
        TargetVersion: "1"

Answer 1

通常，在您的 Detection 模板中，您会 export输出中的 S3BucketEncryptionEnabled。

例如:

Outputs:

    S3BucketEncryptionEnabled:
        Value: !Ref S3BucketEncryptionEnabled
        Export:
            Name: MyS3BucketEncryptionEnabled

然后在您的Remediation 模板中，您将使用ImportValue导入导出的值。

例如:

BasicRemediationConfiguration:
    Type: "AWS::Config::RemediationConfiguration"
    Properties:
        Automatic: True
        MaximumAutomaticAttempts: 5
        RetryAttemptSeconds: 60
        ConfigRuleName: !ImportValue MyS3BucketEncryptionEnabled
        # remaining properties