SNS 主题未收到 CodeBuild 通知

Question

尝试让 CodeBuild 通过 CloudWatch Events 规则将通知推送到 SNS 主题（绑定到 Lambda）。

Cloudformation 模板（见下文）部署良好。

CodeBuild 过程运行良好（已测试）。

SNS 主题和绑定的 Lambda 工作正常 - 我可以通过 AWS CLI 将消息推送到主题并看到 Lambda 将该消息转储到 Cloudwatch 日志。

Cloudwatch 事件规则似乎配置良好 - 我可以在控制台中看到它，它看起来格式正确，似乎绑定到 SNS 主题。

此外，我已经小心地为事件规则赋予了一个具有 sns:Publish 权限的角色，并且还为 SNS 主题定义了一个 AWS::SNS::TopicPolicy -

但仍然没有 - CodeBuild 成功完成但我没有收到任何通知。

有什么问题吗？

TIA :)

---
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  AppName:
    Type: String
  StagingBucket:
    Type: String
  RepoOwner:
    Type: String
  RepoName:
    Type: String
  RepoBranch:
    Type: String
  RepoPAT:
    Type: String
  CodeBuildBuildSpec:
    Type: String
  CodeBuildType:
    Type: String
    Default: LINUX_CONTAINER
  CodeBuildComputeType:
    Type: String
    Default: BUILD_GENERAL1_SMALL
  CodeBuildImage:
    Type: String
    Default: aws/codebuild/standard:4.0
  LambdaHandler:
    Type: String
    Default: "index.handler"
  LambdaMemory:
    Type: Number
    Default: 128
  LambdaTimeout:
    Type: Number
    Default: 30
  LambdaRuntime:
    Type: String
    Default: python3.8
Resources:
  CodeBuildProject:
    DependsOn:
      - CodeBuildSourceCredential
    Properties:
      Environment:
        ComputeType:
          Ref: CodeBuildComputeType
        Image:
          Ref: CodeBuildImage
        Type:
          Ref: CodeBuildType
      Name:
        Ref: AppName
      ServiceRole:
        Fn::GetAtt:
          - CodeBuildRole
          - Arn
      Source:
        Location:
          Fn::Sub:
            - "https://github.com/${repo_owner}/${repo_name}.git"
            - repo_owner:
                Ref: RepoOwner
              repo_name:
                Ref: RepoName
        Type: GITHUB
        BuildSpec:
          Fn::Sub:
            - "${build_spec}"
            - build_spec:
                Ref: CodeBuildBuildSpec
      Artifacts:
        Type: S3
        Location:
          Ref: StagingBucket
      SourceVersion:
        Ref: RepoBranch
      Triggers:
        Webhook: true
        FilterGroups:
          - - Type: EVENT
              Pattern: PUSH
              ExcludeMatchedPattern: false
            - Type: HEAD_REF
              Pattern: "refs/tags/.*"
              ExcludeMatchedPattern: false
    Type: AWS::CodeBuild::Project
  CodeBuildSourceCredential:
    Type: AWS::CodeBuild::SourceCredential
    Properties:
      Token:
        Ref: RepoPAT
      ServerType: GITHUB
      AuthType: PERSONAL_ACCESS_TOKEN
  CodeBuildRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
        Version: '2012-10-17'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AdministratorAccess
      Path: /
    Type: AWS::IAM::Role
  CodeBuildNotificationFunction:
    Properties:
      Code:
        ZipFile: "def handler(event, context):\n  print (event)"
      Handler:
        Ref: LambdaHandler
      MemorySize:
        Ref: LambdaMemory
      Role:
        Fn::GetAtt:
          - CodeBuildNotificationFunctionRole
          - Arn
      Runtime:
        Ref: LambdaRuntime
      Timeout:
        Ref: LambdaTimeout
    Type: AWS::Lambda::Function
  CodeBuildNotificationFunctionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                Effect: Allow
                Resource: '*'
            Version: '2012-10-17'
          PolicyName: code-build-notification-role-policy
    Type: AWS::IAM::Role
  CodeBuildNotificationTopic:
    Properties:
      Subscription:
        - Protocol: lambda
          Endpoint:
            Fn::GetAtt:
              - CodeBuildNotificationFunction
              - Arn
    Type: AWS::SNS::Topic
  CodeBuildNotificationTopicPolicy:
    Properties:
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: "events.amazonaws.com"
            Action:
              - "sns:Publish"
            Resource:
              Ref: CodeBuildNotificationTopic
      Topics:
        - Ref: CodeBuildNotificationTopic
    Type: AWS::SNS::TopicPolicy
  CodeBuildNotificationLambdaInvokePermission:
    Properties:
      Action: "lambda:InvokeFunction"
      FunctionName:
        Ref: CodeBuildNotificationFunction
      Principal: "sns.amazonaws.com"
      SourceArn:
        Ref: CodeBuildNotificationTopic
    Type: AWS::Lambda::Permission
  SampleNotificationRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        Fn::Sub:
          - '{"source": ["aws.codebuild"], "detail-type": ["Codebuild Build Phase Change"], "detail": {"completed-phase": ["SUBMITTED", "PROVISIONING", "DOWNLOAD_SOURCE", "INSTALL", "PRE_BUILD", "BUILD", "POST_BUILD", "UPLOAD_ARTIFACTS", "FINALIZING"], "completed-phase-status": ["TIMED_OUT", "STOPPED", "FAILED", "SUCCEEDED", "FAULT", "CLIENT_ERROR"], "project-name": ["${project_name}"]}}'
          - project_name:
              Ref: CodeBuildProject
      State: ENABLED
      RoleArn:
        Fn::GetAtt:
          - SampleNotificationRuleRole
          - Arn
      Targets:
        - Arn:
            Ref: CodeBuildNotificationTopic
          Id: sample-notification
  SampleNotificationRuleRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
        Version: '2012-10-17'
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - "sns:Publish"
                Effect: Allow
                Resource: '*'
            Version: '2012-10-17'
          PolicyName: sample-notification-rule-role-policy
    Type: AWS::IAM::Role

Answer 1

已修复 - AWS::Events::Rule 目标缺少一个 InputTransformer 方块，就像这样

      Targets:
        - Arn:
            Ref: CodeBuildNotificationTopic
          Id: sample-notification
          InputTransformer:
            InputPathsMap:
              build-id: "$.detail.build-id"
              project-name: "$.detail.project-name"
              completed-phase: "$.detail.completed-phase"
              completed-phase-status: "$.detail.completed-phase-status"
            InputTemplate: |
              "Build '<build-id>' for build project '<project-name>' has completed the build phase of '<completed-phase>' with a status of '<completed-phase-status>'."

SNS 主题未收到 CodeBuild 通知

SNS topic not receiving CodeBuild notifications

amazon-cloudwatch

amazon-sns

aws-codebuild