要将 CW 事件从 CloudFormation 中的 Acc1 中继到 Acc2,需要三件事:
1. Acc2-EventBusPolicy
AWS::事件::EventBusPolicy https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-events-eventbuspolicy.html它允许 Acc1 提交事件。例如:
MyEventBusPolicy:
Type: AWS::Events::EventBusPolicy
Properties:
Action: events:PutEvents
EventBusName: default
Principal: 2234322123 # Account1 Id
StatementId: AcceptEventsFromAcc1
2. Acc1 - CW 的 Iam 角色
允许 Acc1 中的 CW Events 将事件发布到 Acc 2 的 IAM 角色。示例:
MyCWEventsRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service: [events.amazonaws.com]
Action: ["sts:AssumeRole"]
Description: Role for CW event to be able to publish events to acc2
Policies:
- PolicyName: MyEventPolicy
PolicyDocument: !Sub |
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"events:PutEvents"
],
"Resource": [
"arn:aws:events:${RegionId}:${AccountId}:event-bus/default"
]
}
]
}
where AccountId
and RegionId
是 Acc2 值,而不是 Acc1。
3. Acc1 - CW Event 规则将事件依赖于 Acc2 的总线
它将使用步骤 2 中的 IAM 角色。例如,依赖 CodeCommits 事件(我之前设置过,所以我知道它有效):
MyRule:
Type: AWS::Events::Rule
Properties:
Description: Monitor master branch of our repo and rely to Acc2
EventPattern: !Sub |
{
"source": [
"aws.codecommit"
],
"detail-type": [
"CodeCommit Repository State Change"
],
"resources": [
"${GitRepoArn}"
],
"detail": {
"event": [
"referenceCreated",
"referenceUpdated"
],
"referenceType": [
"branch"
],
"referenceName": [
"master"
]
}
}
State: ENABLED
Targets:
- Arn: !Sub "arn:aws:events:${RegionId}:${AccountId}:event-bus/default"
Id: MyEventToAcc2
RoleArn: !GetAtt MyCWEventsRole.Arn
where AccountId
and RegionId
是 Acc2 值,而不是 Acc1。