资源定义格式错误

Question

我正在编写一个用于构建 ECR 存储库的 cloudformation 模板。我使用事件模式构建了它，仅当图像扫描具有高或严重漏洞时才会在图像被推送到存储库时通知我。为了简单起见，我首先构建了它，而不是向 SNS 发送通知，它只是在 Cloudwatch 日志中创建了一个日志条目。这一切都运作良好，但现在我正试图让它通过 SNS 发送电子邮件，但我遇到了问题。我在主题策略中尝试了几种不同的方法，例如 !GetAtt ScanReportTopic.arn 作为 Resources 的值，我还尝试了 Resources: "*" 和其他一些方法。

我不确定还可以尝试什么。这是我正在使用的模板（电子邮件混淆）

Resources:

  EventBusTestRuleCritical:
    Type: AWS::Events::Rule
    Properties: 
      EventBusName: default
      EventPattern:
        source:
          - aws.ecr
        detail-type:
          - ECR Image Scan
        detail:
          finding-severity-counts:
            CRITICAL:
            - exists: true
      Targets: 
        - Arn: !Ref ScanReportTopic
          Id: ScanReporting
  
  EventBusTestRuleHigh:
    Type: AWS::Events::Rule
    Properties: 
      EventBusName: default
      EventPattern:
        source:
          - aws.ecr
        detail-type:
          - ECR Image Scan
        detail:
          finding-severity-counts:
            HIGH:
            - exists: true
      Targets: 
        - Arn: !Ref ScanReportTopic
          Id: ScanReporting

  ECRTestRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: TestScanRepo #Optional
      ImageScanningConfiguration:
        scanOnPush: "true"

  ScanReportTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: scanTopic #Optional
      Subscription:
      - Endpoint: notreal@fakemail.com
        Protocol: email
      # TopicName: Optional
  
  TopicPolicy:
  Type: AWS::SNS::TopicPolicy
  Properties:
    Topics:
      - 
        !Ref ScanReportTopic
    PolicyDocument:
      Id: !Ref ScanReportTopic
      Statement:
      - Sid: __default_statement_ID
        Effect: Allow
        Action: sns:Publish
        Resource: !Ref ScanReportTopic
        Principal: !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default'

Answer 1

TopicPolicy 下的所有内容都需要缩进更多：

  TopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - 
          !Ref ScanReportTopic
      PolicyDocument:
        Id: !Ref ScanReportTopic
        Statement:
        - Sid: __default_statement_ID
          Effect: Allow
          Action: sns:Publish
          Resource: !Ref ScanReportTopic
          Principal: !Sub 'arn:aws:events:${AWS::Region}:${AWS::AccountId}:event-bus/default'

建议在编写模板以及自动完成和文档链接时尝试使用 VSCode 中的 CloudFormation Linter 来查看其中的一些内联错误：

Answer 2

除了@PatMyron 写的内容之外，您的模板中还有几个错误：

1. RepositoryName 不能有大写。

2. TopicPolicy 中的Principal 不正确。应该是events.amazonaws.com。

3. PolicyDocument 中的Id 不应是 ARN。

顺便说一下，TopicPolicy 中的Resource 是正确的。

更正模板：

Resources:

  EventBusTestRuleCritical:
    Type: AWS::Events::Rule
    Properties: 
      EventBusName: default
      EventPattern:
        source:
          - aws.ecr
        detail-type:
          - ECR Image Scan
        detail:
          finding-severity-counts:
            CRITICAL:
            - exists: true
      Targets: 
        - Arn: !Ref ScanReportTopic
          Id: ScanReporting
  
  EventBusTestRuleHigh:
    Type: AWS::Events::Rule
    Properties: 
      EventBusName: default
      EventPattern:
        source:
          - aws.ecr
        detail-type:
          - ECR Image Scan
        detail:
          finding-severity-counts:
            HIGH:
            - exists: true
      Targets: 
        - Arn: !Ref ScanReportTopic
          Id: ScanReporting

  ECRTestRepo:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: testscanrepo #Optional
      ImageScanningConfiguration:
        scanOnPush: "true"

  ScanReportTopic:
    Type: AWS::SNS::Topic
    Properties:
      DisplayName: scanTopic #Optional
      Subscription:
      - Endpoint: notreal@fakemail.com
        Protocol: email
      # TopicName: Optional
  
  TopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      Topics:
        - 
          !Ref ScanReportTopic
      PolicyDocument:
        Id: PolicyForMySNSTopic
        Statement:
        - Sid: AllowEvents
          Effect: Allow
          Action: sns:Publish
          Resource: !Ref ScanReportTopic
          Principal: {Service: events.amazonaws.com}