我可以通过以下组合来做到这一点：
-
在接受者帐户中
- 添加了一个 SNS 主题
- 添加了一个使用 boto3 创建路由条目的 lambda 函数。它接收对等连接 id 和 CIDR，并将其添加到接受方 VPC 的路由表中
- 添加了从 SNS 主题触发 lambda 的权限
- 更新了 PeerRole 以允许跨账户访问 sns:Publish on Arn of the topic
- 添加了一个主题策略以允许在 sns 主题上跨帐户发布
-
在请求者帐户上
- 添加了一个 lambda，它使用 VPC Peer Id 和 CIDR 向 SNS 主题发送消息
有点冗长，但这里是接受器模板的 json 的一部分
"AcceptVPCPeerLambdaExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"Path": "/",
"Policies": [
{
"PolicyName": "CrossAccountVPCPeering",
"PolicyDocument": {
"Statement": [
{
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:GetLogEvents",
"logs:PutLogEvents",
],
"Resource": [ "arn:aws:logs:*:*:*" ],
"Effect": "Allow"
},
{
"Effect":"Allow",
"Action":["ec2:*Route*"],
"Resource":"*"
}
]
}
}
],
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": [ "sts:AssumeRole" ],
"Effect": "Allow",
"Principal": {
"Service": [ "lambda.amazonaws.com" ]
}
}]
}
}
},
"AcceptVPCPeerLambdaFunction": {
"DependsOn": ["AcceptVPCPeerLambdaExecutionRole"],
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"ZipFile" : { "Fn::Join" : ["\n", [
"import json",
"import boto3",
"import logging",
"logger = logging.getLogger()",
"logger.setLevel(logging.INFO)",
"def handler(event, context):",
" message = json.loads(event['Records'][0]['Sns']['Message'])",
" #logger.info('got event {}'.format(event))",
" logger.info('message {}'.format(message))",
" client = boto3.client('ec2')",
" response = client.create_route(",
" DestinationCidrBlock=message.get('destCidrBlock'),",
" VpcPeeringConnectionId=message.get('ReqVpcPeeringId'),",
{"Fn::Sub" : [" RouteTableId='${RouteTableId}'", {"RouteTableId" : {"Ref" : "PrivateRouteTable"}}]},
" )",
" logger.info('response code is {} '.format(",
" response['Return']",
" ))",
]]
}
},
"Description": "Accept A VPC Peering Connection From Requested By Another Account",
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [ "AcceptVPCPeerLambdaExecutionRole", "Arn" ]
},
"Timeout": 300,
"Runtime": "python2.7"
}
},
"AcceptVPCPeerSNSTopic": {
"DependsOn": [ "AcceptVPCPeerLambdaFunction" ],
"Type": "AWS::SNS::Topic",
"Properties": {
"Subscription": [{
"Endpoint": {"Fn::GetAtt": [ "AcceptVPCPeerLambdaFunction", "Arn" ]},
"Protocol": "lambda"
}]
}
},
"SNSTopicPolicy" : {
"Type" : "AWS::SNS::TopicPolicy",
"Properties" :{
"PolicyDocument" : {
"Version":"2012-10-17",
"Id":"AWSAccountTopicAccess",
"Statement" :[
{
"Sid":"allow-publish-vpc-peering",
"Effect":"Allow",
"Principal" :{
"AWS": {"Ref": "PeerRequesterAccounts"}
},
"Action":["sns:Publish"],
"Resource" : "*"
}
]
},
"Topics" : [ {"Ref" : "AcceptVPCPeerSNSTopic"}]
}
}
请求者模板的 Lambda 是
"VpcPeeringConnection": {
"Type": "AWS::EC2::VPCPeeringConnection",
"DependsOn" : ["VPC"],
"Properties": {
"VpcId": {
"Ref": "VPC"
},
"PeerVpcId": {
"Ref": "PeerVPCId"
},
"PeerOwnerId": {
"Ref": "PeerVPCAccountId"
},
"PeerRoleArn": {
"Ref": "PeerRoleArn"
},
"Tags" : [
{"Key" : "Name", "Value" : "DevOps Account To VPN Account"}
]
}
},
"RequesterVPCPeerLambdaFunction": {
"DependsOn": ["RequesterVPCPeerLambdaExecutionRole", "VPC", "VpcPeeringConnection"],
"Type": "AWS::Lambda::Function",
"Properties": {
"Code": {
"ZipFile" : { "Fn::Join" : ["\n", [
"import json",
"import boto3",
"import cfnresponse",
"def handler(event, context):",
" message = {",
{ "Fn::Sub": [ " 'ReqVpcPeeringId' : '${VpcPeeringId}',", { "VpcPeeringId": {"Ref" : "VpcPeeringConnection" }} ]},
{ "Fn::Sub": [ " 'destCidrBlock' : '${destCidrBlock}'", { "destCidrBlock": {"Ref" : "TestPrivateSubnet1Cidr" }} ]},
" }",
" client = boto3.client('sns')",
" response = client.publish(",
{ "Fn::Sub": [ " TargetArn='${TargetArn}',", { "TargetArn": {"Ref" : "AcceptVPCPeerSNSTopicArn" }} ]},
" Message=json.dumps({'default': json.dumps(message)}),",
" MessageStructure='json'",
" )"
]]
}
},
"Description": "Lambda Function To Publish the VPC Peering Connection Id to The VPN Accepter SNS Topic",
"MemorySize": 128,
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [ "RequesterVPCPeerLambdaExecutionRole", "Arn" ]
},
"Timeout": 300,
"Runtime": "python2.7"
}
}