如何在 WebACLAssociation 的 CloudFormation 堆栈中获取 CloudFront 分配 ARN？

Question

我已经在 CloudFormation 中设置了一个 CloudFront 分布，并且正在构建一个 AWS WAF ACL 作为它的防火墙。为了将 ACL 关联到 CloudFront 分配，我添加了一个 AWS::WAFv2::WebACLAssociation 条目，该条目需要 ResourceArn 条目的 CloudFront 分配的 ARN。但是，我似乎无法找到如何从 official documentation 获取 CloudFront 分发 ARN。我以为我可以使用 !Ref，但它根据文档使用 CloudFront ID 而不是 ARN。

如何从 WebACLAssociation 条目引用 CloudFront 分配 ARN？

示例如下（为简洁起见省略了其他资源）：

---
AWSTemplateFormatVersion: 2010-09-09
Description: CloudFront

Parameters:
  # ...
  CloudFront:
    Type: AWS::CloudFront::Distribution
    DependsOn:
      - IssuedCertificate
      - S3Bucket
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !Sub
              - ${S3Bucket}.${S3WebEndpoint}
              - {
                  S3Bucket: !Ref S3Bucket,
                  S3WebEndpoint:
                    !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint],
                }
            Id: S3origin
            CustomOriginConfig:
              OriginProtocolPolicy: http-only
        Enabled: "true"
        Comment: !Sub Distribution for ${DomainName}
        HttpVersion: http2
        Aliases:
          - !Ref DomainName
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          TargetOriginId: S3origin
          Compress: True
          DefaultTTL: 604800
          ForwardedValues:
            QueryString: "false"
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
  # ...
  AWSWAF:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: allowlist
      Description: Allowlist
      Scope: CLOUDFRONT
      DefaultAction:
        Block: {}
      Rules:
        - Name: ipset-rule
          Priority: 0
          Action:
            Allow: {}
          Statement:
            IPSetReferenceStatement:
              Arn: # <ARN>
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: ipset-metrics
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: allowlist-metrics

  AWSWAFAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: !Ref CloudFront
      WebACLArn: !Ref AWSWAF

Answer 1

没有相同的直接属性，但您可以构造它：

arn:aws:cloudfront::${AWS::AccountId}:distribution/${CloudFront}

Answer 2

原来我一直都在错误地处理问题。深入研究文档，我发现 AWS 详细介绍了如何为 CloudFront 分发部署 ACL here under the ResouceArn entry。

要解决此问题，我所要做的就是将以下内容添加到 CloudFront 分发 DistributionConfig 并删除 WebACLAssociation 条目：

WebACLId: !GetAtt AWSWAF.Arn

所以最终的 CloudFront 条目如下所示：

  CloudFront:
    Type: AWS::CloudFront::Distribution
    DependsOn:
      - IssuedCertificate
      - S3Bucket
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !Sub
              - ${S3Bucket}.${S3WebEndpoint}
              - {
                  S3Bucket: !Ref S3Bucket,
                  S3WebEndpoint:
                    !FindInMap [RegionMap, !Ref "AWS::Region", websiteendpoint],
                }
            Id: S3origin
            CustomOriginConfig:
              OriginProtocolPolicy: http-only
        Enabled: "true"
        Comment: !Sub Distribution for ${DomainName}
        HttpVersion: http2
        Aliases:
          - !Ref DomainName
        DefaultCacheBehavior:
          AllowedMethods:
            - GET
            - HEAD
            - OPTIONS
          TargetOriginId: S3origin
          Compress: True
          DefaultTTL: 604800
          ForwardedValues:
            QueryString: "false"
            Cookies:
              Forward: none
          ViewerProtocolPolicy: redirect-to-https
        PriceClass: PriceClass_100
        ViewerCertificate:
          AcmCertificateArn: !Ref Certificate
          SslSupportMethod: sni-only
        WebACLId: !GetAtt AWSWAF.Arn

如何在 WebACLAssociation 的 CloudFormation 堆栈中获取 CloudFront 分配 ARN？

How to get the CloudFront distribution ARN in a CloudFormation stack for WebACLAssociation?

amazon-web-services

yaml

amazon-cloudformation

amazon-cloudfront

amazon-waf