amazon-web-services - aws CodePipeline 手动批准被跳过

Question

我们有从 CodeCommit 存储库中提取代码并构建和部署代码的管道。

在 Source 阶段和 Build 阶段之间，有一个手动批准阶段，由于随机原因，有时会跳过此阶段，而 Pipeline 会直接继续到 Build 阶段，而不会被批准或拒绝。有时即使获得批准，手动批准阶段仍将处于等待批准状态。有时，一旦推送任何代码，批准阶段就会与源代码同时触发。

奇怪的是，这只发生在使用 CloudFormation 模板创建的两个管道上。

在一年或使用 aws CodePipeline 的工作中，我从未经历过这样的事情。

批准阶段被跳过的例子

批准阶段与来源阶段同时触发的示例:

CloudFormation 模板:

AWSTemplateFormatVersion: 2010-09-09
Description: >-
  Pipeline for React mobile WebApps. Creates a CodePipeline, along with a Deployment S3 that hosts the static and a CodeBuild Project to build and package the project 

Parameters:
  RepositoryName: 
    Type: String
    Description: Name of repository to build from
  RepositoryBranch:
    Type: String
    Description: The branch to pull from and build
    Default: master
    AllowedValues:
      - master
      - staging
  ApiURL:
    Type: String
    Description: domain of the api to be used by the web app
  SocketURL:
    Type: String
    Description: url of the socket to be used by the web app
  SentryURL:
    Type: String
    Description: url of sentry 
  CloudfrontURL:
    Type: String
    Description: url of storage

Resources:
  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    DependsOn: CodeBuildRole
    Properties:
      Name: !Join
        - '-'
        - - !Ref RepositoryName
          - !Ref RepositoryBranch
          - build
          - project
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Environment: 
        Type: LINUX_CONTAINER
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/nodejs:8.11.0
        EnvironmentVariables:
        - Name: S3_URL
          Value: !Join
            - '-'
            - - !Ref RepositoryName
              - !Ref RepositoryBranch
        - Name: ENV
          Value: !Ref RepositoryBranch
        - Name: API_DOMAIN
          Value: !Ref ApiURL
        - Name: SOCKET_URL
          Value: !Ref SocketURL
        - Name: SENTRY_URL
          Value: !Ref SentryURL
        - Name: AWS_CLOUDFRONT_URL
          Value: !Ref CloudfrontURL
      Source:
        Type: CODEPIPELINE
        BuildSpec: !Sub |
          version: 0.2
          phases:
            install:
              commands:
                - echo "installing dependencies"
                - npm install
            pre_build:
               commands:
                - echo "building static files"
                - npm run build
                - echo "static files finished building"
            build:
              commands:
                - echo "build phase started"
                - aws s3 sync ./dist s3://${DeploymentBucket}/ --cache-control max-age=0
                - echo "build complete"
      Artifacts:
        Type: CODEPIPELINE
  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - codebuild.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: codebuild-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: "*"
            Resource: "*"
          Version: '2012-10-17'
  CodePipeline:
    Type: 'AWS::CodePipeline::Pipeline'
    DependsOn:
      - CodePipelineTrustRole
    Properties:
      Stages:
        - Name: Source
          Actions:
            - InputArtifacts: []
              Name: Source
              ActionTypeId:
                Category: Source
                Owner: AWS
                Version: '1'
                Provider: CodeCommit
              OutputArtifacts:
                - Name: MyApp
              Configuration:
                PollForSourceChanges: false
                BranchName: !Ref RepositoryBranch
                RepositoryName: !Ref RepositoryName
              RunOrder: 1
        - Name: Approval
          Actions:
            - InputArtifacts: []
              Name: Approval
              ActionTypeId: 
                Category: Approval
                Owner: AWS
                Version: '1'
                Provider: Manual
              OutputArtifacts: []
              Configuration:
              RunOrder: 1
        - Name: BuildAndDeploy
          Actions:
            - InputArtifacts:
                - Name: MyApp
              Name: CodeBuild
              ActionTypeId:
                Category: Build
                Owner: AWS
                Version: '1'
                Provider: CodeBuild
              OutputArtifacts:
                - Name: MyAppBuild
              Configuration:
                ProjectName: !Ref CodeBuildProject
              RunOrder: 1
        - Name: Invalidation
          Actions:
            - InputArtifacts: []
              Name: Invalidate-CloudFront
              ActionTypeId: 
                Category: Invoke
                Owner: AWS
                Version: '1'
                Provider: Lambda
              Configuration:
                FunctionName: "Cloudfront-Invalidator"
                UserParameters: !Sub '{"S3Bucket": "${DeploymentBucket}"}'
              OutputArtifacts: []
              RunOrder: 1
      ArtifactStore:
        Type: S3
        Location: pipeline-store-bucket
      RoleArn: !GetAtt
        - CodePipelineTrustRole
        - Arn
      Name: !Join 
        - '-'
        - - !Ref RepositoryName
          - !Ref RepositoryBranch
          - pipeline
  CodePipelineTrustRole:
    Type: 'AWS::IAM::Role'
    Description: Creates service role in IAM for AWS CodePipeline
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - codepipeline.amazonaws.com
            Sid: 1
      Path: /
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 's3:GetObject'
                  - 's3:GetObjectVersion'
                  - 's3:GetBucketVersioning'
                  - 's3:PutObject'
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - 'pipeline-store-bucket'
                      - '/*'
                  - !Join
                    - ''
                    - - 'arn:aws:s3:::'
                      - 'pipeline-store-bucket'
              - Action:
                  - 'codecommit:CancelUploadArchive'
                  - 'codecommit:GetBranch'
                  - 'codecommit:GetCommit'
                  - 'codecommit:GetUploadArchiveStatus'
                  - 'codecommit:UploadArchive'
                Effect: Allow
                Resource:
                  - !Join 
                    - ':'
                    - - arn
                      - aws
                      - codecommit
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - !Ref RepositoryName
              - Action:
                  - 'codebuild:StartBuild'
                  - 'codebuild:BatchGetBuilds'
                  - 'codebuild:StopBuild'
                Effect: Allow
                Resource: '*'
              - Action:
                  - 'cloudformation:DescribeStacks'
                  - 'cloudformation:DescribeChangeSet'
                  - 'cloudformation:CreateChangeSet'
                  - 'cloudformation:DeleteChangeSet'
                  - 'cloudformation:ExecuteChangeSet'
                Effect: Allow
                Resource: '*'
              - Action: 
                  - 'sns:Publish'
                Effect: Allow
                Resource: '*'
              - Action:
                  - 'lambda:*'
                  - 'cloudwatch:*'
                  - 'events:*'
                  - 'codepipeline:PutJobSuccessResult'
                  - 'codepipeline:PutJobFailureResult'
                Effect: Allow
                Resource: '*'
          PolicyName: CodePipelineTrustPolicy
      RoleName: !Join 
        - '-'
        - - !Ref AWS::StackName
          - CodePipeline
          - Role
  SourceEvent:
    Type: 'AWS::Events::Rule'
    Properties:
      Description: >-
        Rule for Amazon CloudWatch Events to detect changes to the source
        repository and trigger pipeline execution
      EventPattern:
        detail:
          event:
            - referenceCreated
            - referenceUpdated
          referenceName:
            - !Ref RepositoryBranch
          referenceType:
            - branch
        detail-type:
          - CodeCommit Repository State Change
        resources: 
            - !Join 
              - ':'
              - - arn
                - aws
                - codecommit
                - !Ref 'AWS::Region'
                - !Ref 'AWS::AccountId'
                - !Ref RepositoryName
        source:
          - aws.codecommit
      Name: !Join 
        - '-'
        - - !Ref RepositoryName
          - !Ref RepositoryBranch
          - SourceEvent
      State: ENABLED
      Targets:
        - Arn: !Join 
            - ':'
            - - arn
              - aws
              - codepipeline
              - !Ref 'AWS::Region'
              - !Ref 'AWS::AccountId'
              - !Join 
                - '-'
                - - !Ref RepositoryName
                  - !Ref RepositoryBranch
                  - pipeline
          Id: ProjectPipelineTarget
          RoleArn: !GetAtt SourceEventRole.Arn
  SourceEventRole:
    Type: 'AWS::IAM::Role'
    Description: >-
      IAM role to allow Amazon CloudWatch Events to trigger AWS CodePipeline
      execution
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service:
                - events.amazonaws.com
            Sid: 1
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - 'codepipeline:StartPipelineExecution'
                Effect: Allow
                Resource:
                  - !Join 
                    - ':'
                    - - arn
                      - aws
                      - codepipeline
                      - !Ref 'AWS::Region'
                      - !Ref 'AWS::AccountId'
                      - !Join 
                        - '-'
                        - - !Ref RepositoryName
                          - !Ref RepositoryBranch
                          - pipeline
          PolicyName: CodeStarWorkerCloudWatchEventPolicy
      RoleName: !Join
        - '-'
        - - CodePipeline
          - !Ref RepositoryName
          - !Ref RepositoryBranch
          - CloudWatchEventRule
  DeploymentBucket:
    Type: 'AWS::S3::Bucket'
    Description: >-
      S3 Bucket to host the website built from the CodeCommit repository
    Properties:
      AccessControl: PublicRead
      WebsiteConfiguration:
        IndexDocument: index.html
        ErrorDocument: index.html
      BucketName: !Join 
        - '-'
        - - !Ref 'RepositoryName'
          - !Ref 'RepositoryBranch'
    DeletionPolicy: Delete
  DeploymentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Description: >-
      Policy for the web hosting deployment S3 bucket
    Properties:
      Bucket: !Ref DeploymentBucket
      PolicyDocument:
        Statement: 
          - Sid: PublicReadForGetBucketObjectsxw
            Effect: Allow
            Principal: '*'
            Action: s3:GetObject
            Resource: !Join ['', ['arn:aws:s3:::', !Ref 'DeploymentBucket', /*]]
  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Description: A CloudFront Distribution for the website hosting S3 buckets 
    DependsOn: DeploymentBucket
    Properties:
      DistributionConfig:
        Origins:
        - DomainName: !Join
            - '.'
            - - !Ref DeploymentBucket
              - s3
              - amazonaws
              - com
          Id: !Join
            - '-'
            - - S3
              - !Ref DeploymentBucket
          CustomOriginConfig:
            HTTPPort: 80
            HTTPSPort: 443
            OriginProtocolPolicy: https-only
        Enabled: true
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
            - PUT
            - POST
            - PATCH
            - DELETE
          ForwardedValues:
            QueryString: 'false'
            Cookies:
              Forward: none
          TargetOriginId: !Join
            - '-'
            - - S3
              - !Ref DeploymentBucket
          ViewerProtocolPolicy: redirect-to-https
        IPV6Enabled: true
        DefaultRootObject: index.html

Outputs:
  PipelineURL:
    Value: !Sub https://console.aws.amazon.com/codepipeline/home?region=${AWS::Region}#/view/${CodePipeline}
    Description: URL for the CodePipeline of this stack
  SiteUrl:
    Value: !GetAtt [DeploymentBucket, WebsiteURL]
    Description: URL for the S3 Website
  CodeBuildUrl:
    Value: !Sub https://eu-west-1.console.aws.amazon.com/codebuild/home?${AWS::Region}#/projects/${CodeBuildProject}/view
    Description: URL for the CodeBuild Project of this stack
  RepositoryUrl:
    Value: !Sub https://eu-west-1.console.aws.amazon.com/codesuite/codecommit/repositories/${RepositoryName}/browse?region=eu-west-1
    Description: URL for the repository of this stack

Answer 1

每个 CodePipeline 阶段都可以有不同的版本，这样您就可以，例如。在部署到 prod 的先前版本的同时测试 beta 中的新版本。不过，一个阶段中的所有操作都运行同一组版本(工件)。

CodePipeline 不会基于源提交 ID 进行重复数据删除，因为通常需要重新发布相同的源提交(例如，因为构建将拉取更新的依赖项，或者因为您想在之后将事物重置为干净状态，例如. 回滚)。

这意味着在不同阶段可以有具有相同源提交 ID 的不同版本。您转到“查看历史记录”页面来验证这一点。

Example of Approval stage getting skipped

在这个打印屏幕中，我怀疑有 2 个变化。 C1 之前已获得批准，现在部署在“BuildAndDeploy”中。 C2是在“Source”中显示Succeeded，在“Approval”中等待审批的变更。

Example of Approval stage getting triggered at the same time as the Source stage:

这也是2版本的情况。 Source 中有一个版本，Approval 中有另一个版本。