amazon-web-services - 从 CodePipeline 跨区域访问 CodeCommit 存储库

Question

我正在使用 CloudFormation 构建 CodePipeline。该管道部署到 eu-west-1 区域，但它必须从位于 us-east-1 区域的 CodeCommit 存储库获取源代码。

管道定义如下所示:

CodePipeline:
  Type: AWS::CodePipeline::Pipeline
  Properties:
    Name: !Ref PipelineName
    RoleArn: !GetAtt CodePipelineServiceRole.Arn
    Stages:
      - Name: Source
        Actions:
          - Name: Source
            ActionTypeId:
              Category: Source
              Owner: AWS
              Provider: CodeCommit
              Version: 1
            OutputArtifacts:
              - Name: SourceCodeOutputArtifact
            Configuration:
              RepositoryName: !Ref MyRepository
              BranchName: !Ref DeploymentBranch
            RunOrder: 1
            Region: us-east-1

附加的角色和策略如下所示:

CodePipelineServiceRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Version: 2012-10-17
      Statement:
        - Effect: Allow
          Action:
            - sts:AssumeRole
          Principal:
            Service:
              - codepipeline.amazonaws.com

CodePipelineServicePolicy:
  Type: AWS::IAM::Policy
  Properties:
    PolicyName: CodePipelineServicePolicy
    Roles:
      - !Ref CodePipelineServiceRole
    PolicyDocument:
      Version: 2012-10-17
      Statement:
......
        - Effect: Allow
          Action:
            - codecommit:BatchGet*
            - codecommit:BatchDescribe*
            - codecommit:Get*
            - codecommit:Describe*
            - codecommit:List*
            - codecommit:GitPull
          Resource: !Sub "arn:aws:codecommit:us-east-1:${AWS::AccountId}:MyRepository*"

唉，代码管道仍然无法访问我在 us-east-1 中的存储库，或者它正在错误的区域中查找它，因此我出现以下错误

The service role or action role doesn’t have the permissions required to access the AWS CodeCommit repository named MyRepository. Update the IAM role permissions, and then try again. Error: User: arn:aws:sts::111111111111:assumed-role/MyPipeline-CodePipelineServiceRole-N996SC3JYINW/1564844186052 is not authorized to perform: codecommit:GetBranch on resource: arn:aws:codecommit:eu-west-1:111111111111:MyRepository

任何帮助将不胜感激。

编辑:我知道我可以将存储库复制到另一个区域，但我想知道有什么方法可以在不将存储库复制到另一个区域的情况下完成我想做的事情？

Answer 1

您需要将代码提交复制到其他区域。您可以通过使用 CI 作业、ECS 或 Fargate 中的计划容器来完成此操作。