aws-cloudformation - 无服务器 cfn 资源引用无法解析

Question

我是无服务器新手，正在尝试使用无服务器 3 框架创建部署。我目前定义了一些资源，引用了我在模板中定义的其他 cfn 资源，即:

  WebsiteBucketPolicy:
    Type: AWS::S3::BucketPolicy
    DependsOn:
      - CloudFrontOriginAccessIdentity
      - WebsiteBucket
    Properties:
      Bucket: WebsiteBucket
      PolicyDocument:
        Statement:
          - Sid: PublicReadGetObject
            Effect: Allow
            Principal:
              AWS:
                Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', CloudFrontOriginAccessIdentity ] ]
            Action:
              - s3:GetObject
            Resource:
              - Fn::Join: [ '', [ 'arn:aws:s3:::', WebsiteBucket, '/*' ] ]

但是，我在部署时不断收到 cfn 错误，因为对这些资源的引用似乎无法解析。我尝试查看 serverless-state.json 输出文件来进行故障排除，我看到它们定义如下，例如:

"WebsiteBucketPolicy": {
          "Type": "AWS::S3::BucketPolicy",
          "DependsOn": [
            "CloudFrontOriginAccessIdentity",
            "WebsiteBucket"
          ],
          "Properties": {
            "Bucket": "WebsiteBucket",
            "PolicyDocument": {
              "Statement": [
                {
                  "Sid": "PublicReadGetObject",
                  "Effect": "Allow",
                  "Principal": {
                    "AWS": {
                      "Fn::Join": [
                        " ",
                        [
                          "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity",
                          "CloudFrontOriginAccessIdentity"
                        ]
                      ]
                    }
                  },
                  "Action": [
                    "s3:GetObject"
                  ],
                  "Resource": [
                    {
                      "Fn::Join": [
                        "",
                        [
                          "arn:aws:s3:::",
                          "WebsiteBucket",
                          "/*"
                        ]
                      ]
                    }
                  ]
                }
              ]
            }
          }
        },

我在模板中是否错误地引用了这些内容？

Answer 1

要正确引用资源，您需要使用 Ref功能:

Bucket: !Ref WebsiteBucket

关于您的模板的另外两个注释:

• 在这种情况下，您可以省略 DependsOn 部分，因为您正在引用正在等待的所有资源。使用 Ref 时，CloudFormation 会自动按正确的顺序创建资源(在本例中，首先是存储桶和访问身份，最后是存储桶策略)
• 除了使用 Join 来组合字符串和参数之外，您还可以使用 Sub返回类似 ${WebsiteBucket} 格式的引用值的函数，就像 Ref/GetAtt 一样。

模板:

WebsiteBucketPolicy:
  Type: AWS::S3::BucketPolicy
  Properties:
    Bucket: !Ref WebsiteBucket
    PolicyDocument:
      Statement:
        - Sid: PublicReadGetObject
          Effect: Allow
          Principal:
            AWS:
              Fn::Join: [ ' ', [ 'arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity', !Ref CloudFrontOriginAccessIdentity ] ]
          Action:
            - s3:GetObject
          Resource:
            - !Sub arn:aws:s3:::${WebsiteBucket}/*
            # OR:
            # - Fn::Join: [ '', [ 'arn:aws:s3:::', !Ref WebsiteBucket, '/*' ] ]