我可以强制 CloudFormation 删除非空 S3 存储桶吗？

有没有办法强制 CloudFormation 删除非空 S3 存储桶？

您可以创建一个拉姆达函数清理您的存储桶并使用以下命令从 CloudFormation 堆栈调用您的 lambda自定义资源.

下面是清理存储桶的 lambda 示例：

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import json
import boto3
from botocore.vendored import requests


def lambda_handler(event, context):
    try:
        bucket = event['ResourceProperties']['BucketName']

        if event['RequestType'] == 'Delete':
            s3 = boto3.resource('s3')
            bucket = s3.Bucket(bucket)
            for obj in bucket.objects.filter():
                s3.Object(bucket.name, obj.key).delete()

        sendResponseCfn(event, context, "SUCCESS")
    except Exception as e:
        print(e)
        sendResponseCfn(event, context, "FAILED")


def sendResponseCfn(event, context, responseStatus):
    response_body = {'Status': responseStatus,
                     'Reason': 'Log stream name: ' + context.log_stream_name,
                     'PhysicalResourceId': context.log_stream_name,
                     'StackId': event['StackId'],
                     'RequestId': event['RequestId'],
                     'LogicalResourceId': event['LogicalResourceId'],
                     'Data': json.loads("{}")}

    requests.put(event['ResponseURL'], data=json.dumps(response_body))

创建上面的 lambda 后，只需将 CustomResource 放入您的 CloudFormation 堆栈中：

 ---
 AWSTemplateFormatVersion: '2010-09-09'

 Resources:

   myBucketResource:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: my-test-bucket-cleaning-on-delete

   cleanupBucketOnDelete:
     Type: Custom::cleanupbucket
     Properties:
       ServiceToken: arn:aws:lambda:eu-west-1:123456789012:function:clean-bucket-lambda
       BucketName: !Ref myBucketResource

请记住将一个角色附加到您的 lambda，该角色有权从您的存储桶中删除对象。

此外请记住，您可以使用 lambda 函数创建接受 CLI 命令行的 lambda 函数cli2cloudformation。您可以从以下位置下载并安装here https://github.com/lucioveloso/cli2cloudformation/。使用它你只需要创建一个 CustomResource ，如下所示：

"removeBucket": {
        "Type": "Custom::cli2cloudformation",
        "Properties": {
          "ServiceToken": "arn:aws:lambda:eu-west-1:123456789000:function:custom-lambda-name",
          "CliCommandDelete": "aws s3 rb s3://bucket-name --force",
        }
}