Cfn-Lint：属性 "ExecutionRoleArn" 在 Resources/TaskDefinition/Properties/ExecutionRoleArn/Ref 没有对资源的有效引用

Question

我正在为运行 AWS 上的 ECS 集群和 ECS 任务构建一个 cloudformation 模板。

我也在使用带有插件 Cfn-Lint 的 Atom 文本编辑器。

我在 Atom 文本编辑器中的 cfn linter 验证中遇到以下问题，如图所示。

分享一些代码片段

Resources:
  # A role needed by ECS
  ExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Join ['', [!Ref ServiceName, ExecutionRole]]
      AssumeRolePolicyDocument:
        Statement:
          - Effect: Allow
            Principal:
              Service: [ecs-tasks.amazonaws.com]
            Action: ['sts:AssumeRole']
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    # Makes sure the log group is created before it is used.
    Properties:
      # Name of the task definition. Subsequent versions of the task definition are grouped together under this name.
      Family: !Join ['', [!Ref ServiceName, TaskDefinition]]
      # awsvpc is required for Fargate
      NetworkMode: awsvpc
      RequiresCompatibilities:
        - FARGATE
      # 256 (.25 vCPU) - Available memory values: 0.5GB, 1GB, 2GB
      # 512 (.5 vCPU) - Available memory values: 1GB, 2GB, 3GB, 4GB
      # 1024 (1 vCPU) - Available memory values: 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB
      # 2048 (2 vCPU) - Available memory values: Between 4GB and 16GB in 1GB increments
      # 4096 (4 vCPU) - Available memory values: Between 8GB and 30GB in 1GB increments
      Cpu: "2048"
      # 0.5GB, 1GB, 2GB - Available cpu values: 256 (.25 vCPU)
      # 1GB, 2GB, 3GB, 4GB - Available cpu values: 512 (.5 vCPU)
      # 2GB, 3GB, 4GB, 5GB, 6GB, 7GB, 8GB - Available cpu values: 1024 (1 vCPU)
      # Between 4GB and 16GB in 1GB increments - Available cpu values: 2048 (2 vCPU)
      # Between 8GB and 30GB in 1GB increments - Available cpu values: 4096 (4 vCPU)
      Memory: 8GB
      # A role needed by ECS.
      # "The ARN of the task execution role that containers in this task can assume. All containers in this task are granted the permissions that are specified in this role."
      # "There is an optional task execution IAM role that you can specify with Fargate to allow your Fargate tasks to make API calls to Amazon ECR."
      ExecutionRoleArn: !Ref ExecutionRole

最后一行代码 ExecutionRoleArn: !Ref ExecutionRole 给出了 Cfn-Lint Atom 插件中的错误。

尽管模板运行成功并创建了部署。

Answer 1

要获得 Arn，您必须使用 GetAtt 固有函数：

ExecutionRoleArn: !GetAtt ExecutionRole.Arn

Cfn-Lint：属性 "ExecutionRoleArn" 在 Resources/TaskDefinition/Properties/ExecutionRoleArn/Ref 没有对资源的有效引用

Cfn-Lint : Property "ExecutionRoleArn" has no valid Refs to Resources at Resources/TaskDefinition/Properties/ExecutionRoleArn/Ref

amazon-web-services

amazon-ecs

amazon-cloudformation

atom-editor