是否可以创建一个CodePipeline,其目标源是另一个账户中的CodeCommit存储库?
是否可以创建一个CodePipeline,其目标源是另一个账户中的CodeCommit存储库?
我必须这样做,我将解释过程。
账户C是您的CodeCommit存储库的帐户。 账户P是拥有您的CodePipeline...流水线的帐户。
在P账户中:
创建AWS KMS加密密钥并添加C账户以获取访问权限(在前提步骤中指南这里)。 您还需要添加CodePipeline角色,如果有CodeBuild和CodeDeploy步骤,则还需要添加这些角色。
在CodePipeline工件S3存储桶中,您需要添加C账户访问权限。 转到Bucket策略并添加:
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNTC_ID:root"
},
"Action": [
"s3:Get*",
"s3:Put*"
],
"Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/*"
},
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::ACCOUNTC_ID:root"
},
"Action": "s3:ListBucket",
"Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"
}
将ACCOUNTC_ID
更改为Account C的帐户ID,并将YOUR_BUCKET_NAME
更改为CodePipeline构件S3存储桶名称。
3. 向您的CodePipeline服务角色添加策略,以便您可以访问Account C和CodeCommit代码库:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Allow",
"Action": "sts:AssumeRole",
"Resource": [
"arn:aws:iam::ACCOUNTC_ID:role/*"
]
}
}
请将ACCOUNTC_ID
更改为账户C的账户ID。
在账户C中:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject*",
"s3:PutObject",
"s3:PutObjectAcl",
"codecommit:ListBranches",
"codecommit:ListRepositories"
],
"Resource": [
"arn:aws:s3:::YOUR_BUCKET_NAME_IN_ACCOUNTP_FOR_CODE_PIPELINE/*"
]
},
{
"Effect": "Allow",
"Action": [
"kms:DescribeKey",
"kms:GenerateDataKey*",
"kms:Encrypt",
"kms:ReEncrypt*",
"kms:Decrypt"
],
"Resource": [
"arn:aws:kms:YOUR_KMS_ARN"
]
}
]
}
在上述策略中替换存储桶名称和KMS ARN。将该策略保存为类似CrossAccountPipelinePolicy的东西。
在AWS CLI中,无法在控制台中执行此操作,因此必须使用AWS CLI。这是为了让您在Source步骤中使您的CodePipeline在AccountP中扮演角色并将其转储到S3存储桶中,以供您的下一步使用。
aws codepipeline get-pipeline --name NameOfPipeline > pipeline.json
修改管道json,使其看起来像这样,并替换所需的部分:
"pipeline": {
"name": "YOUR_PIPELINE_NAME",
"roleArn": "arn:aws:iam::AccountP_ID:role/ROLE_NAME_FOR_CODE_PIPELINE",
"artifactStore": {
"type": "S3",
"location": "YOUR_BUCKET_NAME",
"encryptionKey": {
"id": "arn:aws:kms:YOUR_KMS_KEY_ARN",
"type": "KMS"
}
},
"stages": [
{
"name": "Source",
"actions": [
{
"name": "Source",
"actionTypeId": {
"category": "Source",
"owner": "AWS",
"provider": "CodeCommit",
"version": "1"
},
"runOrder": 1,
"roleArn": "arn:aws:iam::AccountC_ID:role/ROLE_NAME_WITH_CROSS_ACCOUNT_POLICY",
"configuration": {
"BranchName": "master",
"PollForSourceChanges": "false",
"RepositoryName": "YOURREPOSITORYNAME"
},
"outputArtifacts": [
{
"name": "MyApp"
}
],
"inputArtifacts": []
}
]
},
使用aws codepipeline update-pipeline --cli-input-json file://pipeline.json
更新流水线。
通过运行流水线来验证它是否有效。
调用UpdatePipeline操作时发生错误(AccessDeniedException):不允许跨帐户传递角色。
你能帮忙吗? - Bhatasana Prashant您可以使用代码提交库在另一个账户中使用管道部署资源。
假设您有 A 账户,其中包含您的代码提交库,以及 B 账户,其中包含您的代码管道。
在 B 账户中配置以下内容:
You would need to create custom KMS key because AWS Default Key does not have an associated Key policy. You can use Create a Pipeline in CodePipeline That Uses Resources from Another AWS Account if you need assistance with creating CMK. Add the Codepipeline service role to the KMS Key Policy to allow the codepipeline to use it.
Event bus for receiving events from cross account Go to CloudWatch → Event Buses under Events section → Add Permission → Enter DEV AWS Account Id → Add. For more details, check Creating an Event Bus
Add the following Policy to S3 pipeline Artifact store:
{
“Version”: “2012–10–17”,
“Id”: “PolicyForKMSAccess”,
“Statement”: [
{ “Sid”: “AllowAccessFromAAccount”,
“Effect”: “Allow”,
“Principal”: { “AWS”: “arn:aws:iam::ACCOUNT_A_ID:root” },
“Action”: [ “s3:Get*”, “s3:Put*”, "s3:ListBucket ],
“Resource”: “arn:aws:s3:::NAME-OF-THE-BUCKET/*” }
]
}
Edit the Pipeline IAM rols to assume role to Account A as follows:
{
“Version”:“2012–10–17”,
“Statement”:{
“Effect”:“Allow”,
“Action”:“sts:AssumeRole”,
“Resource”:[
“arn:aws:iam::ACCOUNT_A_ID:role/*
]
}
}
现在,在账户A中执行以下操作:
创建一个跨账户的IAM角色,其中包含3个策略。 a) AWSCodeCommitFullAccess
b) 内联策略以如下方式假定角色为账户B:
{
“Version”:“2012–10–17”,
“Statement”:[
{
“Effect”:“Allow”,
“Principal”:{
“AWS”:“arn:aws:iam::ACCOUNT_B_ID:root”
},
“Action”:“sts:AssumeRole”
}
]
}
c)KMS、CodeCommit和S3访问的内联策略:
{
“Version”:“2012–10–17”,
“Statement”:[
{
“Effect”:“Allow”,
“Action”:[
“s3:Get*”,
“s3:Put*”,
“codecommit:*”
],
“Resource”:[
“arn:aws:s3:::YOUR_BUCKET_NAME_IN_B_FOR_CODE_PIPELINE_ARTIFACTS/”
]
},
{
“Effect”:“Allow”,
“Action”:[
“kms:*" ],
“Resource”: [ “arn:aws:kms:YOUR_KMS_ARN_FROM_B_ACCOUNT” ] } ] }
2. 按照 Eran Medan 建议的方式更新您的流水线。
更多详细信息,请访问 AWS CodePipeline 跨账户 CodeCommit 存储库
此外,请注意,我授予了比所需权限更多的权限,例如 codecommit:* 和 kms:*,您可以根据需要进行更改。
希望这能帮到你。