Cloudwatch 自定义事件 SQS 无法工作

Question

我正在使用 Terraform 创建队列，同时还创建 Cloudwatch 事件规则并将其中一个队列设置为规则的目标。

总而言之，我有一个队列是 3 个单独的 cloudwatch 事件的目标。问题是，即使 cloudwatch 事件规则相同，但只有其中一个在通过 terraform 创建时起作用，其他最终在控制台中作为失败调用而没有日志或任何类型的可调试信息。如果自定义事件是从 aws 控制台创建的，则一切正常。

在terraform中创建队列

resource "aws_sqs_queue" "queue_cron" {
  name                       = "cron"
  visibility_timeout_seconds = 300 # 5 minutes
  delay_seconds              = 0
  message_retention_seconds  = 1800 # 30 minutes
  receive_wait_time_seconds  = 20
}

唯一的工作块

resource "aws_cloudwatch_event_rule" "eve_vendors_bot_sync" {
  name                = "vendors-bot-sync"
  schedule_expression = "rate(1 minute)"
  description         = "Notify cron queue for vendors bot sync"
  is_enabled          = true
}

resource "aws_cloudwatch_event_target" "sqs_cron_vendors_bot_sync" {
  rule      = aws_cloudwatch_event_rule.eve_vendors_bot_sync.name
  arn       = var.queue_cron_arn
  target_id = "sqsCronVendorBotSync"

  input_transformer {
    input_template = <<EOF
{
   "messageType":"cron",
   "cronType":"vendors-bot-sync"
}
EOF
  }
}

尽管结构与上面的相同，但不起作用。

resource "aws_cloudwatch_event_rule" "eve_restos_sync" {
  name                = "restos-sync"
  schedule_expression = "rate(1 minute)"
  description         = "Notify cron queue for restos sync"
  is_enabled          = true
}

resource "aws_cloudwatch_event_target" "sqs_cron_restos_sync" {
  rule      = aws_cloudwatch_event_rule.eve_restos_sync.name
  arn       = var.queue_cron_arn
  target_id = "sqsCronRestosSync"

  input_transformer {
    input_template = <<EOF
{
   "messageType":"cron",
   "cronType":"restaurant-hours-open-close-management"
}
EOF
  }
}

与上面的类似，不起作用

resource "aws_cloudwatch_event_rule" "eve_vendors_orders_sync" {
  name                = "vendors-orders-sync"
  schedule_expression = "rate(1 minute)"
  description         = "Notify cron queue for vendors orders sync"
  is_enabled          = true
}
resource "aws_cloudwatch_event_target" "target_cron_vendors_sync" {
  rule      = aws_cloudwatch_event_rule.eve_vendors_orders_sync.name
  arn       = var.queue_cron_arn
  target_id = "sqsCronVendorsOrderSync"

  input_transformer {
    input_template = <<EOF
{
   "messageType":"cron",
   "cronType":"vendors-orders-sync"
}
EOF
  }
}

回答

正如@Marchin 正确指出的那样，难题中缺失的部分确实是阻止 cloudwatch 向 SQS 发送消息的策略。这是让它工作的更新配置。

创建队列
创建允许 cloudwatch 将消息发送到队列的策略
将策略附加到队列

resource "aws_sqs_queue" "queue_cron" {
  name                       = "cron"
  visibility_timeout_seconds = 300 # 5 minutes
  delay_seconds              = 0
  message_retention_seconds  = 1800 # 30 minutes
  receive_wait_time_seconds  = 20
}

data "aws_iam_policy_document" "policy_sqs" {
  statement {

    sid    = "AWSEvents_"
    effect = "Allow"
    actions = [
      "sqs:SendMessage",
    ]

    principals {
      type        = "Service"
      identifiers = ["events.amazonaws.com"]
    }

    resources = [aws_sqs_queue.queue_cron.arn]

  }
}

resource "aws_sqs_queue_policy" "cron_sqs_policy" {

  queue_url = aws_sqs_queue.queue_cron.id
  policy    = data.aws_iam_policy_document.policy_sqs.json

}

Answer 1

我认为您对 SQS 队列的权限缺失或不正确。假设您正在 terraform 中创建 queue_cron（问题中未显示），允许 CW Events 向其发送消息的队列及其策略将是：

data "aws_caller_identity" "current" {}

data "aws_region" "current" {}

resource "aws_sqs_queue" "queue_cron" {
  name   = "queue_cron"
}

resource "aws_sqs_queue_policy" "test" {

  queue_url = aws_sqs_queue.queue_cron.id

  policy = <<POLICY
{
  "Version": "2012-10-17",
  "Id": "sqspolicy",
  "Statement": [
    {
      "Sid": "First",
      "Effect": "Allow",
      "Principal": {
        "AWS": "${data.aws_caller_identity.current.account_id}"
      },
      "Action": "sqs:*",
      "Resource": "${aws_sqs_queue.queue_cron.arn}"
    },
    {
      "Sid": "AWSEvents_",
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Action": "sqs:SendMessage",
      "Resource": "${aws_sqs_queue.queue_cron.arn}",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:events:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:rule/*"
        }
      }
    }  
  ]
}
POLICY
}

Cloudwatch 自定义事件 SQS 无法工作

Cloudwatch Custom Events SQS fails to work

amazon-web-services

amazon-cloudwatch

terraform

terraform-provider-aws

amazon-cloudwatch-events

在terraform中创建队列

唯一的工作块

尽管结构与上面的相同，但不起作用。

与上面的类似，不起作用

回答