aws-cloudformation - 如何根据是否定义 key 有条件地创建 AWS::Events::Connection 资源

Question

我目前有这个云形成模板，该模板应该创建具有所有必要配置的事件桥资源，但我无法创建它，因为我无法让云形成来验证 key 中是否存在 key 是否是 secret 管理员。

更清楚地说，我希望仅在我的 key ${Stage}/${SubDomain}/django-events-api 时创建我的 event-bridge.yml 模板资源-key 已在 secret 管理器中定义并具有有效值(意味着它不仅具有空字符串或 AWS::NoValue)；这是因为我需要在堆栈创建和部署之后、堆栈未部署之前创建 key ，所以我无法执行命令来生成 key

我有这个:

event-bridge.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Event scheduling for sending the email digest"
Parameters:
  SubDomain:
    Description: The part of a website address before your DomainName - e.g. www or img
    Type: String
  DomainName:
    Description: The part of a website address after your SubDomain - e.g. example.com
    Type: String
  Stage:
    Description: Stage name (e.g. dev, test, prod)
    Type: String
  DjangoApiKey:
    Description: Api key for events bridge communication
    Type: String

Conditions:
  DjangoApiKeyExists: !Or [ !Not [ !Equals [ !Ref DjangoApiKey,  !Ref AWS::NoValue ] ], !Not [ !Equals [ !Ref DjangoApiKey,  "" ] ] ]

Outputs:
  DjangoEventsConnection:
    Description: Connection to the Django backend for Event Bridge
    Value: !Ref DjangoEventsConnection

Resources:
  MessageDigestEventsRule:
    Type: AWS::Events::Rule
    Properties:
      Name: !Sub "${SubDomain}-chat-digest"
      Description: "Send out email digests for a chat"
      ScheduleExpression: "rate(15 minutes)"
      State: "ENABLED"
      Targets:
        - Arn: !GetAtt MessageDigestEventsApiDestination.Arn
          HttpParameters:
            HeaderParameters: { }
            QueryStringParameters: { }
          Id: !Sub "${SubDomain}-chat-digest-api-target"
          RoleArn: !GetAtt MessageDigestEventsRole.Arn
      EventBusName: "default"

  DjangoEventsConnection:
    Type: AWS::Events::Connection
    Properties:
      Name: !Sub "${SubDomain}-django"
      AuthorizationType: "API_KEY"
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: "Authorization"
          ApiKeyValue: !Ref DjangoApiKey

在 main.yml 模板中，我传递关键变量，如下所示:

  EventBridge:
    DependsOn: [ VpcStack, DjangoEventBridgeApiKey ]
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: ./event-bridge.yaml
      Parameters:
        SubDomain: !Ref SubDomain
        DomainName: !Ref DomainName
        Stage: !Ref Stage
        DjangoApiKey: !Sub '{{resolve:secretsmanager:arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${SubDomain}/django-events-api-key}}' <--

但这总是会失败，因为 key 未定义，我想传递一个空字符串或可以用作条件的东西

我也尝试过定义 secret ，所以它存在:

Resources:
  DjangoEventBridgeApiKey:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${Stage}/${SubDomain}/django-events-api-key
      Description: !Sub Credentials for the event bridge integration https://api.${SubDomain}.circular.co
      Tags:
        - Key: Name
          Value: django-events-api-key
  EventBridge:
    DependsOn: [ VpcStack, DjangoEventBridgeApiKey ]
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: ./event-bridge.yaml
      Parameters:
        SubDomain: !Ref SubDomain
        DomainName: !Ref DomainName
        Stage: !Ref Stage
        DjangoApiKey: !Sub '{{resolve:secretsmanager:${DjangoEventBridgeApiKey}}}'

但是由于某种原因，仍然使我的上述条件失败，使堆栈尝试执行，我仍然无法弄清楚为什么我的条件不起作用

关于如何让它变得更好有什么想法吗？提供的任何帮助对我来说都非常有用

Answer 1

好吧，在 event-bridge.yml 上发现了我的实现中最大的问题:

AWSTemplateFormatVersion: "2010-09-09"
Description: "Event scheduling for sending the email digest of chat messages"
Parameters:
  SubDomain:
    Description: The part of a website address before your DomainName - e.g. www or img
    Type: String
  DomainName:
    Description: The part of a website address after your SubDomain - e.g. example.com
    Type: String
  Stage:
    Description: Stage name (e.g. dev, test, prod)
    Type: String
  DjangoApiKey:
    Description: Api key for events bridge communication
    Type: String

Conditions:
  DjangoApiKeyExists: !Not [ !Equals [ !Ref DjangoApiKey,  "" ] ] # <-- this works

Outputs:
  DjangoEventsConnection:
    Condition: DjangoApiKeyExists
    Description: Connection to the django backend for Event Bridge
    Value: !Ref DjangoEventsConnection

Resources:
  DjangoEventsConnection:
    Type: AWS::Events::Connection
    Condition: DjangoApiKeyExists
    Properties:
      Name: !Sub "${SubDomain}-django"
      AuthorizationType: "API_KEY"
      AuthParameters:
        ApiKeyAuthParameters:
          ApiKeyName: "Authorization"
          ApiKeyValue: !Ref DjangoApiKey
          # This does not update when we change the secret - so we need to force an update - need a more permanent solution
          # ApiKeyValue: pop

  MessageDigestEventsApiDestination:
    Type: AWS::Events::ApiDestination
    Condition: DjangoApiKeyExists
    DependsOn: DjangoEventsConnection

在main.yml

上

...
  DjangoEventBridgeApiKey:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${Stage}/${SubDomain}/django-events-api-key # <- this was missing ${Stage}
      SecretString: " "
      Tags:
        - Key: Name
          Value: django-events-api-key
  EventBridge:
    DependsOn: DjangoEventBridgeApiKey
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: ./event-bridge.yaml
      Parameters:
        SubDomain: !Ref SubDomain
        DomainName: !Ref DomainName
        Stage: !Ref Stage
        DjangoApiKey: !Sub '{{resolve:secretsmanager:arn:aws:secretsmanager:${AWS::Region}:${AWS::AccountId}:secret:${Stage}/${SubDomain}/django-events-api-key}}'
      Tags:
        - Key: Stage
          Value: !Ref Stage
        - Key: SubDomain
          Value: !Ref SubDomain
        - Key: SecretKeyName
          Value: !Ref DjangoEventBridgeApiKey