AWS CDK交叉帐户Lambda部署权限问题

Question

我按照下面的教程使用CDK创建Lambda部署管道。当我试着把所有的东西都放在同一个账户里时，它会很好地运作。https://docs.aws.amazon.com/cdk/latest/guide/codePipeline_example.html

但我的场景与示例略有不同，因为它涉及两个AWS帐户，而不是一个。我在OPS帐户中维护应用程序源代码和管道，这个管道将把Lambda应用程序部署到UAT帐户。

OPS帐户（12345678）-CodeCommit repo和CodePipeline UAT帐户（87654321）-Lambda应用程序

根据aws后续aws文档（跨帐户操作部分），我对源代码做了以下更改。https://docs.aws.amazon.com/cdk/api/latest/docs/aws-codepipeline-actions-readme.html

>

lambda堆栈公开部署操作角色，如下所示

导出类LambdaStack扩展了cdk.stack{public readonly deployactionrole：iam.role；

constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    ...

    this.deployActionRole = new iam.Role(this, 'ActionRole', {
          assumedBy: new iam.AccountPrincipal('12345678'), //pipeline account
          // the role has to have a physical name set
          roleName: 'DeployActionRole',
     });
}

}

在管道堆栈中,

new codePipeline.Pipeline(this, 'MicroServicePipeline', {
      pipelineName: 'MicroServicePipeline',
      stages: [
        {
          stageName: 'Deploy',
          actions: [
            new codePipelineAction.CloudFormationCreateUpdateStackAction({
              role: props.deployActionRole,
              ....
             }
        }
      ]
}

• 以下是我如何启动堆栈

const app = new cdk.App();

const opsEnv: cdk.Environment = {account: '12345678', region: 'ap-southeast-2'};
const uatEnv: cdk.Environment = {account: '87654321', region: 'ap-southeast-2'};

const lambdaStack = new LambdaStack(app, 'LambdaStack', {env: uatEnv});

const lambdaCode = lambdaStack.lambdaCode;
const deployActionRole = lambdaStack.deployActionRole;
new MicroServicePipelineStack(app, 'MicroServicePipelineStack', {
    env: opsEnv,
    stackName: 'MicroServicePipelineStack',
    lambdaCode,
    deployActionRole
});

app.synth();

• AWS凭据配置文件看起来类似

[profile uatadmin]
role_arn=arn:aws:iam::87654321:role/PigletUatAdminRole
source_profile=opsadmin
region=ap-southeast-2

当我运行cdk diff或deploy时,

➜  infra git:(master) ✗ cdk diff MicroServicePipelineStack --profile uatadmin
Including dependency stacks: LambdaStack
Stack LambdaStack
Need to perform AWS calls for account 87654321, but no credentials have been configured.

我在这里做错了什么？是我的CDK代码还是我配置AWS配置文件的方式？

谢谢，卡孙

Answer 1

问题是您的AWS CLI配置。不能在本地使用CDK CLI通过一个CLI命令在两个单独的帐户中部署资源。最近有一篇关于如何根据堆栈环境参数告诉CDK使用哪些凭据的博客文章：https://aws.amazon.com/blogs/devops/cdk-credential-plugin/

我们使用它的方式是用多个CLI命令指定所需的配置文件将堆栈部署到单独的帐户中。所有需要交换的参数（如lambdaCode的位置）都是通过环境变量传递的。