如何使用CloudFormation或CDK将另一个AWS账户的事件总线指定为EventBridge规则的目标？

Question

如何使用CloudFormation或CDK将另一个AWS账户的事件总线指定为EventBridge规则的目标？

amazon-web-servicesaws-cloudformationamazon-cloudwatchaws-cdk

6

如何使用CloudFormation或CDK将另一个AWS账户的事件总线指定为CloudWatch规则的目标?

以下是使用CDK创建示例规则的示例，我试图将CodeDeploy事件发送到另一个账户：

Rule codedeployCreateDeploymentEventRule = Rule.Builder.create(this, "CodedeployCreateDeploymentEventRule")
                                                   .description("CloudWatch event rule covering CodeDeploy CreateDeployment notifications.")
                                                   .ruleName("MyRule")
                                                   .enabled(true)
                                                   .targets(List.of(...something here...))
                                                   .eventPattern(EventPattern.builder()
                                                                             .source(List.of("aws.codedeploy"))
                                                                             .detail(Map.of("eventName", List.of("CreateDeployment")))
                                                                             .build())
                                                   .build();

如何将另一个账户的EventBus指定为目标？语法是什么 - 是ARN还是其他什么？

- John

问题解决得怎么样了？还是存在吗？ - Marcin

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- Marcin · Accepted Answer

为了在CloudFormation中将CW事件从Acc1中继到Acc2，需要三件事：

1. Acc2 - EventBusPolicy

AWS::Events::EventBusPolicy 允许Acc1提交事件，如：

  MyEventBusPolicy:
    Type: AWS::Events::EventBusPolicy
    Properties: 
      Action: events:PutEvents
      EventBusName: default
      Principal: 2234322123 # Account1 Id
      StatementId: AcceptEventsFromAcc1

2. Acc1 - 为 CW 创建的 Iam 角色

此 IAM 角色允许 Acc1 的 CW 事件发布事件到 Acc2。例如：

  MyCWEventsRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument:                   
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: [events.amazonaws.com]
            Action: ["sts:AssumeRole"]
      Description: Role for CW event to be able to publish events to acc2
      Policies: 
        - PolicyName: MyEventPolicy
          PolicyDocument: !Sub |
            {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Action": [
                            "events:PutEvents"
                        ],
                        "Resource": [
                            "arn:aws:events:${RegionId}:${AccountId}:event-bus/default"
                         ]
                    }
                ]
            }

其中AccountId和RegionId是Acc2的值，而不是Acc1。

3. Acc1 - CW事件规则将事件依赖于Acc2的总线

它将使用步骤2中的IAM角色。例如，要依赖CodeCommits事件（我之前设置过，所以我知道它可行）：

  MyRule:
    Type: AWS::Events::Rule
    Properties: 
      Description: Monitor master branch of our repo and rely to Acc2
      EventPattern: !Sub |
            {
              "source": [
                "aws.codecommit"
              ],
              "detail-type": [
                "CodeCommit Repository State Change"
              ],
              "resources": [
                "${GitRepoArn}"
              ],
              "detail": {
                "event": [
                  "referenceCreated",
                  "referenceUpdated"
                ],
                "referenceType": [
                  "branch"
                ],
                "referenceName": [
                  "master"
                ]
               }
             }  
      State: ENABLED
      Targets: 
        - Arn: !Sub "arn:aws:events:${RegionId}:${AccountId}:event-bus/default"
          Id: MyEventToAcc2
          RoleArn: !GetAtt MyCWEventsRole.Arn

AccountId 和 RegionId 的值应为 Acc2，而不是 Acc1。