amazon-web-services - 云形成模板中Json格式错误

Question

我从我的云形成模板中收到以下错误。使用 json 和纯 yaml 时会发生这种情况。

错误

Resource handler returned message: "Invalid request provided: JSON not well-formed. at Line: 13, Column: 10 (Service: Ssm, Status Code: 400,

带有 json 的模板

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template for Response Plans"
Parameters:
  Environment:
    Type: String
  Domain:
    Type: String
  Team:
    Type: String
  NotificationARN:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /sandbox06/Topics/PolicyData/arn
Resources:
  UpdateAliasResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Actions:
        - SsmAutomation:
            RoleArn: !Ref Role
            DocumentName: UpdateAliasDocument
            # ActionType: UpdateAlias
      DisplayName: "UpdateLambdaAlias"
      # Engagements:
      #   Engagements
      IncidentTemplate:
        Impact: 3
        NotificationTargets:
          - SnsTopicArn:
              Ref: NotificationARN
        Summary: "String"
        Title: "String"
      Name: "UpdateLambdaAlias"
      Tags:
        - Key: "Team"
          Value: !Ref Team
        - Key: "Domain"
          Value: !Ref Domain
        - Key: "Environment"
          Value: !Ref Environment
  UpdateAliasDocument:
    Type: AWS::SSM::Document
    Properties:
      Content: |
        {
          "schemaVersion": "2.2",
          "parameters": {
            "Environment": { "type": "string"},
            "Domain": { "type": "string"},
            "Team": { "type": "string"},
            "NotificationARN": { "type": "string", "default": "/sandbox06/Topics/PolicyData/arn"}
          },
          "mainSteps": [
            { "action": "aws:runShellScript",
              "name": "runCommands",
              "inputs": {
                "runCommand": ["aws lambda update-functionconfiguration --function-name $FunctionArn --version $FunctionVersion"]
            }
          ]
        }
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: UpdateAliasPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-*

带有 yaml 的模板

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template for Response Plans"
Parameters:
  Environment:
    Type: String
  Domain:
    Type: String
  Team:
    Type: String
  NotificationARN:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /sandbox06/Topics/PolicyData/arn
Resources:
  UpdateAliasResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Actions:
        - SsmAutomation:
            RoleArn: !Ref Role
            DocumentName: UpdateAliasDocument
            # ActionType: UpdateAlias
      DisplayName: "UpdateLambdaAlias"
      # Engagements:
      #   Engagements
      IncidentTemplate:
        Impact: 3
        NotificationTargets:
          - SnsTopicArn:
              Ref: NotificationARN
        Summary: "String"
        Title: "String"
      Name: "UpdateLambdaAlias"
      Tags:
        - Key: "Team"
          Value: !Ref Team
        - Key: "Domain"
          Value: !Ref Domain
        - Key: "Environment"
          Value: !Ref Environment
  UpdateAliasDocument:
    Type: AWS::SSM::Document
    Properties:
      Content:
        schemaVersion: "2.2"
        parameters:
          - name: FunctionVersion
            type: "String"
            defaultValue: "1"
          - name: FunctionArn
            type: "String"
        mainSteps:
          - action: aws:runShellScript
            name: "runCommand"
            inputs:
              runCommand: "aws lambda update-function-configuration --function-name $FunctionArn --version $FunctionVersion"
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: UpdateAliasPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-*

另一个 YAML 版本

AWSTemplateFormatVersion: "2010-09-09"
Description: "AWS CloudFormation Template for Response Plans"
Parameters:
  Environment:
    Type: String
  Domain:
    Type: String
  Team:
    Type: String
  NotificationARN:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /sandbox06/Topics/PolicyData/arn
Resources:
  UpdateAliasResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Actions:
        - SsmAutomation:
            RoleArn: !Ref Role
            DocumentName: UpdateAliasDocument
            # ActionType: UpdateAlias
      DisplayName: "UpdateLambdaAlias"
      # Engagements:
      #   Engagements
      IncidentTemplate:
        Impact: 3
        NotificationTargets:
          - SnsTopicArn:
              Ref: NotificationARN
        Summary: "String"
        Title: "String"
      Name: "UpdateLambdaAlias"
      Tags:
        - Key: "Team"
          Value: !Ref Team
        - Key: "Domain"
          Value: !Ref Domain
        - Key: "Environment"
          Value: !Ref Environment
  UpdateAliasDocument:
    Type: AWS::SSM::Document
    Properties:
      Content:
        schemaVersion: "2.2"
        parameters:
          - name: FunctionVersion
            type: "String"
            defaultValue: "1"
          - name: FunctionName
            type: "String"
        mainSteps:
          - name: UpdateLambdaAlias
            action: aws:executeAWSApi
            inputs:
              Service: "lambda"
              Api: UpdateFunctionConfiguration
              FunctionName: $FunctionName
              FunctionVersion: $FunctionVersion
  Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lambda.amazonaws.com
            Action: sts:AssumeRole
      Path: /
      Policies:
        - PolicyName: UpdateAliasPolicy
          PolicyDocument:
            Statement:
              - Effect: Allow
                Action:
                  - lambda:UpdateFunctionConfiguration
                Resource:
                  - !Sub arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:${Environment}-*

Answer 1

当它尝试解析 SSM 参数时，您会收到错误消息。这是 400 错误，因此可能是您没有从 SSM 检索参数的权限。在本例中，它正在寻找 /sandbox06/Topics/PolicyData/arn因此，请验证您用于创建堆栈的帐户是否有权检索该参数。 This article显示所需的权限。

如果是这样，还请验证 SSM 中该参数的值是否会生成有效的模板(如果您将其粘贴到模板中)。验证 SSM parameter类型为String ，如AWS::SSM::Parameter::Value<String>是

A Systems Manager parameter whose value is a string. This correspondsto the String parameter type in Parameter Store.

该链接还提到了以下内容，并在您想要获取安全字符串时提供了替代方案:

AWS CloudFormation does not support defining template parameters asSecureString Systems Manager parameter types.

此外，您可能需要将默认格式设置为不以斜杠开头。 This page显示了一个不以斜杠开头的示例，或者对于以斜杠开头的分层参数，可能需要使用单引号(示例 2 就是这样显示的)