amazon-web-services - 使用 CDK 时，如何使我的 CloudFormation/CodePipeline 更新域名以指向 S3 存储桶？

Question

我正在使用 CDK 部署 CodePipeline，该 CodePipeline 构建 React 应用程序并将其部署到 S3。所有这些都有效，但我希望部署更新域名以指向该 S3 存储桶。

我已经在 Route53 中定义了区域，但它是由不同的云形成堆栈定义的，因为有很多与此应用程序无关的细节(MX、TXT 等)。我的管道/堆栈设置这些域名的正确方法是什么？

我可以想到两种解决方案:

• 将域委托(delegate)给另一个区域，因此区域 example.com代表们staging.example.com .
• 让我的管道将记录注入(inject)到现有区域中。

我没有尝试委托(delegate)区域方法。我有点担心手动维护 staging.example.com 生成的名称服务器。进入我的 CloudFormation 区域 example.com .

我确实尝试将记录注入(inject)现有区域，但遇到了一些问题。我愿意解决这些问题或以正确的方式执行此操作。

在我的堆栈(底部的完整管道)中，我首先定义并部署到存储桶:

const bucket = new s3.Bucket(this, "Bucket", {...})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
    sources: [...],
    destinationBucket: bucket
})

然后我尝试检索区域并添加 CNAME给它:

const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
    zone: dnsZone,
    recordName: "staging",
    domainName: bucket.bucketWebsiteDomainName
})

由于缺乏该区域的权限而失败，这是合理的:

[Container] 2022/01/30 11:35:17 Running command npx cdk synth
current credentials could not be used to assume 'arn:aws:iam::...:role/cdk-hnb659fds-lookup-role-...-us-east-1', but are for the right account. Proceeding anyway.
[Error at /Pipeline/Staging] User: arn:aws:sts::...:assumed-role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S/AWSCodeBuild-ada5ef88-cc82-4309-9acf-11bcf0bae878 is not authorized to perform: route53:ListHostedZonesByName because no identity-based policy allows the route53:ListHostedZonesByName action
Found errors

为了尝试解决这个问题，我添加了 rolePolicyStatements给我的CodeBuildStep

                    rolePolicyStatements: [
                        new iam.PolicyStatement({
                            actions: ["route53:ListHostedZonesByName"],
                            resources: ["*"],
                            effect: iam.Effect.ALLOW
                        })
                    ]

这在整个文件的上下文中可能更有意义(在这个问题的底部)。那没有效果。我不确定政策声明是否错误，或者我将其添加到了错误的角色。

添加 rolePolicyStatements 后，我跑cdk deploy这向我展示了这个输出:

> cdk deploy

✨  Synthesis time: 33.43s

This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:

IAM Statement Changes
┌───┬──────────┬────────┬───────────────────────────────┬───────────────────────────────────────────────────────────┬───────────┐
│   │ Resource │ Effect │ Action                        │ Principal                                                 │ Condition │
├───┼──────────┼────────┼───────────────────────────────┼───────────────────────────────────────────────────────────┼───────────┤
│ + │ *        │ Allow  │ route53:ListHostedZonesByName │ AWS:${Pipeline/Pipeline/Build/Synth/CdkBuildProject/Role} │           │
└───┴──────────┴────────┴───────────────────────────────┴───────────────────────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

部署完成后，我可以在 AWS 控制台中看到一个角色，该角色具有:

        {
            "Action": "route53:ListHostedZonesByName",
            "Resource": "*",
            "Effect": "Allow"
        }

该角色的 ARN 为 arn:aws:iam::...:role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S 。我不能 100% 确定权限是否被授予正确的事物。

这是我的整个 CDK 管道:

import * as path from "path";
import {Construct} from "constructs"
import * as pipelines from "aws-cdk-lib/pipelines"
import * as cdk from "aws-cdk-lib"
import * as s3 from "aws-cdk-lib/aws-s3"
import * as s3d from "aws-cdk-lib/aws-s3-deployment"
import * as iam from "aws-cdk-lib/aws-iam"
import * as route53 from "aws-cdk-lib/aws-route53";

export class MainStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props?: cdk.StageProps) {
        super(scope, id, props)

        const bucket = new s3.Bucket(this, "Bucket", {
            websiteIndexDocument: "index.html",
            websiteErrorDocument: "error.html",
            publicReadAccess: true,
        })

        const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
        new route53.CnameRecord(this, "cname", {
            zone: dnsZone,
            recordName: "staging",
            domainName: bucket.bucketWebsiteDomainName
        })

        new s3d.BucketDeployment(this, "WebsiteDeployment", {
            sources: [s3d.Source.asset(path.join(process.cwd(), "../build"))],
            destinationBucket: bucket
        })
    }
}

export class DeployStage extends cdk.Stage {
    public readonly mainStack: MainStack

    constructor(scope: Construct, id: string, props?: cdk.StageProps) {
        super(scope, id, props)
        this.mainStack = new MainStack(this, "MainStack", {env: props?.env})
    }
}

export interface PipelineStackProps extends cdk.StackProps {
    readonly githubRepo: string
    readonly repoBranch: string
    readonly repoConnectionArn: string
}

export class PipelineStack extends cdk.Stack {
    constructor(scope: Construct, id: string, props: PipelineStackProps) {
        super(scope, id, props)

        const pipeline = new pipelines.CodePipeline(this, id, {
            pipelineName: id,
            synth: new pipelines.CodeBuildStep("Synth", {
                    input: pipelines.CodePipelineSource.connection(props.githubRepo, props.repoBranch, {connectionArn: props.repoConnectionArn}),
                    installCommands: [
                        "npm install -g aws-cdk"
                    ],
                    commands: [
                        // First build the React app.
                        "npm ci",
                        "npm run build",
                        // Now build the CF stack.
                        "cd infra",
                        "npm ci",
                        "npx cdk synth"
                    ],
                    primaryOutputDirectory: "infra/cdk.out",
                    rolePolicyStatements: [
                        new iam.PolicyStatement({
                            actions: ["route53:ListHostedZonesByName"],
                            resources: ["*"],
                            effect: iam.Effect.ALLOW
                        })
                    ]
                },
            ),
        })


        const deploy = new DeployStage(this, "Staging", {env: props?.env})
        const deployStage = pipeline.addStage(deploy)

    }
}

Answer 1

如果合成阶段失败，您不能依赖 CDK 管道自行修复，因为管道 CloudFormation 堆栈在使用合成阶段输出的 SelfMutate 阶段中发生了更改。您将需要执行以下选项之一来修复管道:

1. 在本地(或管道之外的任何地方，您拥有所需的 AWS IAM 权限)运行 cdk Synth 和 cdk 部署 PipelineStack 。 编辑:您需要暂时将 selfMutatation 设置为 false 才能使其正常工作 ( Reference )

2. 暂时从 MainStack 中删除 route53.HostedZone.fromLookup 和 route53.CnameRecord，同时仍保留 rolePolicyStatements 更改。提交并推送您的代码，让 CodePipeline 运行一次，确保 Pipeline self 变异并且 IAM 角色具有所需的额外权限。添加回 Route53 构造，提交，再次推送并检查您的代码是否适用于新的更改。