将 CloudFormation 自定义 SNS 资源转换为 AWS CLI答案

【问题标题】：Convert CloudFormation Custom SNS Resource to AWS CLI将 CloudFormation 自定义 SNS 资源转换为 AWS CLI
【发布时间】：2019-05-08 08:39:35
【问题描述】：

我正在尝试将供应商提供的 CloudFormation Stack 转换为 Terraform。有一个AWS::CloudFormation::CustomResource 用于发送 SNS 通知：

...
"RegistrationNotification": {
  "Type": "AWS::CloudFormation::CustomResource",
  "Version": "1.0",
  "Properties": {
    "ServiceToken": {"Ref" : "SnsTopicRegistration"},
    "Version": "1.0",
    "AccountID": {
      "Ref": "AWS::AccountId"
    },
    "CloudTrailCreated": {
      "Ref": "EnableNewCloudTrail"
    },
    "IamRoleARN": {
      "Fn::GetAtt": [
        "iamRole",
        "Arn"
      ]
    }
  }
}
...

我的计划是为aws sns publish 提供一个本地执行资源。但是，CustomResource 属性是作为消息属性发送还是在消息正文中发送？

这是我迄今为止尝试过的，但我不相信它有效。

message.txt:
{
  "AccountID":"111111111111",
  "CloudTrailCreated":"false",
  "IAMRoleArn":"arn:aws:iam::111111111111:role/TestRole"
}

aws sns publish --target-arn "arn:aws:sns:us-west-2:123456789012:test-topic" --message file://message.txt

【问题讨论】：

标签： amazon-web-services amazon-cloudformation terraform aws-cli

【解决方案1】：

设置我自己的 SNS->SQS 管道并覆盖供应商的 SNS 目标后，我能够看到 CloudFormation 生成的完整消息：

message.txt: 
{
  "RequestType":"Create",
  "ServiceToken":"arn:aws:sns:us-east-1:999999999999:registration",
  "ResponseURL":"https://custom-resource-response-useast1.s3-us-east-1.amazonaws.com/arn%3Aaws%3Acloudformation%3Aus-east-1%3A111111111111%3Astack/Vendor_App/f16ba060-f981-11e8%7CRegistrationNotification%7C754d1dbc-2cc9-4b5f-855a?AWSAccessKeyId=AKIAIBLSGNTMEXAMPLE&Expires=1544126938&Signature=UohvGFPBHWrCz%2BMxgVKHF1L%2FNe4%3D",
  "StackId":"arn:aws:cloudformation:us-east-1:111111111111:stack/Vendor_App/f16ba060-f981-11e8-9ecc",
  "RequestId":"754d1dbc-2cc9-4b5f-855a",
  "LogicalResourceId":"RegistrationNotification",
  "ResourceType":"AWS::CloudFormation::CustomResource",
  "ResourceProperties":{
    "ServiceToken":"arn:aws:sns:us-east-1:999999999999:cs-cloudconnect-manager-registration",
    "AccountID":"111111111111",
    "Version":"1.0",
    "IamRoleARN":"arn:aws:iam::111111111111:role/TestRole",
    "CloudTrailCreated":"false"
  }
}

AWS CloudFormation Custom Resource Request Objects 文档有助于了解哪些字段是必填字段。

最终，我使用本地执行资源的计划失败了，我求助于从 Terraform 调用 CloudFormation 堆栈：

resource "aws_cloudformation_stack" "vendor-stack" {
  name = "Vendor-App-Stack"
  capabilities = [ "CAPABILITY_NAMED_IAM" ]
  parameters {
    RoleName="TestRole"
    EnableNewCloudTrail="false"
  }
  template_url = "https://s3.amazonaws.com/vendor-prod-templates/aws_cloudformation_v1.0.json"
}

【讨论】：