使用 CDK 时，如何让我的 CloudFormation / CodePipeline 更新域名以指向 S3 存储桶？
How do I make my CloudFormation / CodePipeline update a domain name to point to an S3 bucket when using CDK?
我正在使用 CDK 部署一个 CodePipeline，它构建一个 React 应用程序并将其部署到 S3。所有这些都有效，但我希望部署更新域名以指向该 S3 存储桶。
我已经在 Route53 中定义了区域，但它是由不同的云形成堆栈定义的，因为有很多与此应用程序无关的细节（MX、TXT 等）。我的 Pipeline/Stacks 设置这些域名的正确方法是什么？
我可以想到两个解决方案：
- 将域委托给另一个区域，因此区域
example.com 委托 staging.example.com。
- 将我的管道注入 记录到现有区域。
我没有尝试授权区方法。我有点担心将 staging.example.com 生成的名称服务器手动维护到我的区域 example.com.
的 CloudFormation 中
我确实尝试将记录注入现有区域，但我 运行 遇到了一些问题。我愿意解决这些问题或以正确的方式执行此操作。
在我的堆栈（底部的完整管道）中，我首先定义并部署到存储桶：
const bucket = new s3.Bucket(this, "Bucket", {...})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [...],
destinationBucket: bucket
})
然后我尝试检索区域并将 CNAME 添加到其中：
const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})
由于缺少对区域的权限而失败，这是合理的：
[Container] 2022/01/30 11:35:17 Running command npx cdk synth
current credentials could not be used to assume 'arn:aws:iam::...:role/cdk-hnb659fds-lookup-role-...-us-east-1', but are for the right account. Proceeding anyway.
[Error at /Pipeline/Staging] User: arn:aws:sts::...:assumed-role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S/AWSCodeBuild-ada5ef88-cc82-4309-9acf-11bcf0bae878 is not authorized to perform: route53:ListHostedZonesByName because no identity-based policy allows the route53:ListHostedZonesByName action
Found errors
为了解决这个问题，我在 CodeBuildStep
中添加了 rolePolicyStatements
rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]
这在整个文件的上下文中可能更有意义（在这个问题的底部）。那没有效果。我不确定政策声明是否有误，或者我将其添加到错误的角色中。
添加 rolePolicyStatements 之后，我 运行 cdk deploy 向我展示了这个输出：
> cdk deploy
✨ Synthesis time: 33.43s
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:
IAM Statement Changes
┌───┬──────────┬────────┬───────────────────────────────┬───────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼──────────┼────────┼───────────────────────────────┼───────────────────────────────────────────────────────────┼───────────┤
│ + │ * │ Allow │ route53:ListHostedZonesByName │ AWS:${Pipeline/Pipeline/Build/Synth/CdkBuildProject/Role} │ │
└───┴──────────┴────────┴───────────────────────────────┴───────────────────────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
部署完成后，我可以在 AWS 控制台中看到一个角色：
{
"Action": "route53:ListHostedZonesByName",
"Resource": "*",
"Effect": "Allow"
}
角色的 ARN 是 arn:aws:iam::...:role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S。如果权限被授予正确的 thing.
，我不是 100%
这是我的整个 CDK 管道：
import * as path from "path";
import {Construct} from "constructs"
import * as pipelines from "aws-cdk-lib/pipelines"
import * as cdk from "aws-cdk-lib"
import * as s3 from "aws-cdk-lib/aws-s3"
import * as s3d from "aws-cdk-lib/aws-s3-deployment"
import * as iam from "aws-cdk-lib/aws-iam"
import * as route53 from "aws-cdk-lib/aws-route53";
export class MainStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
const bucket = new s3.Bucket(this, "Bucket", {
websiteIndexDocument: "index.html",
websiteErrorDocument: "error.html",
publicReadAccess: true,
})
const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [s3d.Source.asset(path.join(process.cwd(), "../build"))],
destinationBucket: bucket
})
}
}
export class DeployStage extends cdk.Stage {
public readonly mainStack: MainStack
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
this.mainStack = new MainStack(this, "MainStack", {env: props?.env})
}
}
export interface PipelineStackProps extends cdk.StackProps {
readonly githubRepo: string
readonly repoBranch: string
readonly repoConnectionArn: string
}
export class PipelineStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: PipelineStackProps) {
super(scope, id, props)
const pipeline = new pipelines.CodePipeline(this, id, {
pipelineName: id,
synth: new pipelines.CodeBuildStep("Synth", {
input: pipelines.CodePipelineSource.connection(props.githubRepo, props.repoBranch, {connectionArn: props.repoConnectionArn}),
installCommands: [
"npm install -g aws-cdk"
],
commands: [
// First build the React app.
"npm ci",
"npm run build",
// Now build the CF stack.
"cd infra",
"npm ci",
"npx cdk synth"
],
primaryOutputDirectory: "infra/cdk.out",
rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]
},
),
})
const deploy = new DeployStage(this, "Staging", {env: props?.env})
const deployStage = pipeline.addStage(deploy)
}
}
如果合成阶段失败，您不能依赖 CDK 管道自行修复，因为管道 CloudFormation 堆栈在使用合成阶段输出的 SelfMutate 阶段发生了更改。您将需要执行以下选项之一来修复管道：
运行 cdk synth 和 cdk deploy PipelineStack 在本地（或管道外的任何地方，您拥有所需的 AWS IAM 权限）。 编辑：您需要暂时将 selfMutatation 设置为 false 才能正常工作 (Reference)
暂时从您的 MainStack 中删除 route53.HostedZone.fromLookup 和 route53.CnameRecord，同时仍保留 rolePolicyStatements 更改。提交并推送您的代码，让 CodePipeline 运行 一次，确保 Pipeline 自我变异并且 IAM 角色具有所需的额外权限。添加回 route53 构造，提交，再次推送并检查您的代码是否适用于新更改。
我正在使用 CDK 部署一个 CodePipeline，它构建一个 React 应用程序并将其部署到 S3。所有这些都有效，但我希望部署更新域名以指向该 S3 存储桶。
我已经在 Route53 中定义了区域，但它是由不同的云形成堆栈定义的，因为有很多与此应用程序无关的细节（MX、TXT 等）。我的 Pipeline/Stacks 设置这些域名的正确方法是什么？
我可以想到两个解决方案：
- 将域委托给另一个区域，因此区域
example.com委托staging.example.com。 - 将我的管道注入 记录到现有区域。
我没有尝试授权区方法。我有点担心将 staging.example.com 生成的名称服务器手动维护到我的区域 example.com.
我确实尝试将记录注入现有区域，但我 运行 遇到了一些问题。我愿意解决这些问题或以正确的方式执行此操作。
在我的堆栈（底部的完整管道）中，我首先定义并部署到存储桶：
const bucket = new s3.Bucket(this, "Bucket", {...})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [...],
destinationBucket: bucket
})
然后我尝试检索区域并将 CNAME 添加到其中：
const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})
由于缺少对区域的权限而失败，这是合理的：
[Container] 2022/01/30 11:35:17 Running command npx cdk synth
current credentials could not be used to assume 'arn:aws:iam::...:role/cdk-hnb659fds-lookup-role-...-us-east-1', but are for the right account. Proceeding anyway.
[Error at /Pipeline/Staging] User: arn:aws:sts::...:assumed-role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S/AWSCodeBuild-ada5ef88-cc82-4309-9acf-11bcf0bae878 is not authorized to perform: route53:ListHostedZonesByName because no identity-based policy allows the route53:ListHostedZonesByName action
Found errors
为了解决这个问题，我在 CodeBuildStep
rolePolicyStatements
rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]
这在整个文件的上下文中可能更有意义（在这个问题的底部）。那没有效果。我不确定政策声明是否有误，或者我将其添加到错误的角色中。
添加 rolePolicyStatements 之后，我 运行 cdk deploy 向我展示了这个输出：
> cdk deploy
✨ Synthesis time: 33.43s
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:
IAM Statement Changes
┌───┬──────────┬────────┬───────────────────────────────┬───────────────────────────────────────────────────────────┬───────────┐
│ │ Resource │ Effect │ Action │ Principal │ Condition │
├───┼──────────┼────────┼───────────────────────────────┼───────────────────────────────────────────────────────────┼───────────┤
│ + │ * │ Allow │ route53:ListHostedZonesByName │ AWS:${Pipeline/Pipeline/Build/Synth/CdkBuildProject/Role} │ │
└───┴──────────┴────────┴───────────────────────────────┴───────────────────────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)
部署完成后，我可以在 AWS 控制台中看到一个角色：
{
"Action": "route53:ListHostedZonesByName",
"Resource": "*",
"Effect": "Allow"
}
角色的 ARN 是 arn:aws:iam::...:role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S。如果权限被授予正确的 thing.
这是我的整个 CDK 管道：
import * as path from "path";
import {Construct} from "constructs"
import * as pipelines from "aws-cdk-lib/pipelines"
import * as cdk from "aws-cdk-lib"
import * as s3 from "aws-cdk-lib/aws-s3"
import * as s3d from "aws-cdk-lib/aws-s3-deployment"
import * as iam from "aws-cdk-lib/aws-iam"
import * as route53 from "aws-cdk-lib/aws-route53";
export class MainStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
const bucket = new s3.Bucket(this, "Bucket", {
websiteIndexDocument: "index.html",
websiteErrorDocument: "error.html",
publicReadAccess: true,
})
const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [s3d.Source.asset(path.join(process.cwd(), "../build"))],
destinationBucket: bucket
})
}
}
export class DeployStage extends cdk.Stage {
public readonly mainStack: MainStack
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
this.mainStack = new MainStack(this, "MainStack", {env: props?.env})
}
}
export interface PipelineStackProps extends cdk.StackProps {
readonly githubRepo: string
readonly repoBranch: string
readonly repoConnectionArn: string
}
export class PipelineStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: PipelineStackProps) {
super(scope, id, props)
const pipeline = new pipelines.CodePipeline(this, id, {
pipelineName: id,
synth: new pipelines.CodeBuildStep("Synth", {
input: pipelines.CodePipelineSource.connection(props.githubRepo, props.repoBranch, {connectionArn: props.repoConnectionArn}),
installCommands: [
"npm install -g aws-cdk"
],
commands: [
// First build the React app.
"npm ci",
"npm run build",
// Now build the CF stack.
"cd infra",
"npm ci",
"npx cdk synth"
],
primaryOutputDirectory: "infra/cdk.out",
rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]
},
),
})
const deploy = new DeployStage(this, "Staging", {env: props?.env})
const deployStage = pipeline.addStage(deploy)
}
}
如果合成阶段失败，您不能依赖 CDK 管道自行修复，因为管道 CloudFormation 堆栈在使用合成阶段输出的 SelfMutate 阶段发生了更改。您将需要执行以下选项之一来修复管道：
运行
cdk synth和cdk deploy PipelineStack在本地（或管道外的任何地方，您拥有所需的 AWS IAM 权限）。 编辑：您需要暂时将 selfMutatation 设置为false才能正常工作 (Reference)暂时从您的 MainStack 中删除
route53.HostedZone.fromLookup和route53.CnameRecord，同时仍保留rolePolicyStatements更改。提交并推送您的代码，让 CodePipeline 运行 一次，确保 Pipeline 自我变异并且 IAM 角色具有所需的额外权限。添加回 route53 构造，提交，再次推送并检查您的代码是否适用于新更改。