amazon-web-services - 是否可以在同一管道中进行跨帐户和相同帐户部署？

Question

我正在 AWS 中进行从部署帐户到临时帐户的跨帐户部署，我有 2 个用于 API 和前端应用程序的独立管道。

在API的代码管道中，我正在创建一些我想在前端代码管道的构建阶段重用的资源。现在我需要通过运行单个管道来实现以下步骤

1. 将 API 云形成堆栈从部署帐户部署到临时帐户 - 成功完成。
2. 在部署帐户本身中部署一个云形成堆栈 - 不成功，这可能吗？如果可以的话该怎么做呢？

提前致谢

Answer 1

我有一些用例，需要在 AWS 代码构建中执行从我的管理帐户(我运行管道的帐户)到我要部署到的目标帐户的操作。例如，当需要将钓鱼应用程序部署到 S3 时，这非常有用。这是我的解决方案希望这有帮助:)

BuildAngulerProjectAndUploadToS3:
Type: AWS::CodeBuild::Project
Properties:
  Name: !Sub '${UniqueId}-build-anguler-project-upload-to-s3'
  Artifacts:
    Type: CODEPIPELINE
  Environment:
    ComputeType: BUILD_GENERAL1_SMALL
    Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
    Type: LINUX_CONTAINER
  ServiceRole: !Sub '{{resolve:ssm:/${SSMNamespace}/${PipelineSSMConfigId}/pipeline/pipeline_role_arn/mgmt:1}}'
  EncryptionKey: !Sub '{{resolve:ssm:/${SSMNamespace}/${PipelineSSMConfigId}/pipeline/artefact_encryption_key/arn:1}}'
  Source:
    Type: CODEPIPELINE
    BuildSpec:  !Sub |2 # Only use ${...} for substituted variables, not environment variables, to avoid issues with !Sub
      version: 0.2
      env:
        parameter-store:
          artifactory_username: "/${SSMNamespace}/${PipelineSSMConfigId}/pipeline/python-pip/username"
          artifactory_password: "/${SSMNamespace}/${PipelineSSMConfigId}/pipeline/python-pip/api"
      phases:
        pre_build:
            commands:
              # Assume the cross account role in the Target Account
              # CrossAccountDeploymentRoleArn is passed in as an environment variable
              - output=$(aws sts assume-role
                --role-arn $CrossAccountDeploymentRoleArn
                --role-session-name "x-account-code-build"
                --query 'Credentials.[SecretAccessKey,AccessKeyId,SessionToken]'
                --output text)
              - export AWS_ACCESS_KEY_ID=$(echo $output | cut -f2 -d ' ')
              - export AWS_SECRET_ACCESS_KEY=$(echo $output | cut -f1 -d ' ')
              - export AWS_SESSION_TOKEN=$(echo $output | cut -f3 -d ' ')

        install:
          runtime-versions:
            nodejs: 10
          commands:
            - echo Installing source NPM dependencies...
            - cd $CODEBUILD_SRC_DIR/client/app
            - echo Setting up artifactory...
            - printf _auth="$artifactory_password\nregistry=https://{ARTIFACTORY_ADDRESS}\nemail=$artifactory_username\nalways-auth=true" > .npmrc
            - cat .npmrc
            - npm i -g @angular/cli
        build:
          commands:
            - npm install
            - ng build --prod
            - echo uploading artifacts to S3
            - aws s3 sync dist/app s3://${UniqueId}-app-bucket-$Account_ID