当使用CDK时，我如何使我的CloudFormation/CodePipeline更新域名以指向S3 bucket

Question

我正在使用CDK部署一个CodePipeline，它构建并部署React应用程序到S3。所有这些都在起作用，但我希望部署更新域名以指向S3存储桶。

我已经在Route53中定义了Zone，但它是由不同的云形成堆栈定义的，因为有很多细节与此应用程序无关(MX、TXT等(。我的Pipeline/Stacks设置这些域名的正确方法是什么？

我可以想出两个解决方案：

• 将域委派到另一个区域，因此区域example.com委派staging.example.com
• 让我的管道将记录注入现有区域

我没有尝试委派区域方法。我有点担心手动将生成的名称服务器从staging.example.com维护到区域example.com的CloudFormation中。

我确实尝试将记录注入现有区域，但遇到了一些问题。我对解决这些问题或以任何正确的方式这样做持开放态度。

在我的堆栈(底部的完整管道(中，我首先定义并部署到bucket:

const bucket = new s3.Bucket(this, "Bucket", {...})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [...],
destinationBucket: bucket
})

然后我尝试检索该区域并将CNAME添加到其中：

const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})

这是由于缺乏对该区域的权限而失败的，这是合理的：

[Container] 2022/01/30 11:35:17 Running command npx cdk synth
current credentials could not be used to assume 'arn:aws:iam::...:role/cdk-hnb659fds-lookup-role-...-us-east-1', but are for the right account. Proceeding anyway.
[Error at /Pipeline/Staging] User: arn:aws:sts::...:assumed-role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S/AWSCodeBuild-ada5ef88-cc82-4309-9acf-11bcf0bae878 is not authorized to perform: route53:ListHostedZonesByName because no identity-based policy allows the route53:ListHostedZonesByName action
Found errors

为了解决这个问题，我在CodeBuildStep中添加了rolePolicyStatements

rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]

这在整个文件的上下文中可能更有意义(在这个问题的底部(。这没有任何效果。我不确定政策声明是错误的，还是我把它添加到了错误的角色中。

在添加了rolePolicyStatements之后，我运行cdk deploy，它向我显示了以下输出：

> cdk deploy
✨  Synthesis time: 33.43s
This deployment will make potentially sensitive changes according to your current security approval level (--require-approval broadening).
Please confirm you intend to make the following modifications:
IAM Statement Changes
┌───┬──────────┬────────┬───────────────────────────────┬───────────────────────────────────────────────────────────┬───────────┐
│   │ Resource │ Effect │ Action                        │ Principal                                                 │ Condition │
├───┼──────────┼────────┼───────────────────────────────┼───────────────────────────────────────────────────────────┼───────────┤
│ + │ *        │ Allow  │ route53:ListHostedZonesByName │ AWS:${Pipeline/Pipeline/Build/Synth/CdkBuildProject/Role} │           │
└───┴──────────┴────────┴───────────────────────────────┴───────────────────────────────────────────────────────────┴───────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

部署完成后，我可以在AWS控制台中看到一个角色：

{
"Action": "route53:ListHostedZonesByName",
"Resource": "*",
"Effect": "Allow"
}

该角色的ARN为arn:aws:iam::...:role/Pipeline-PipelineBuildSynthCdkBuildProje-1H5AV7C28FZ3S。如果权限被授予正确的东西，我不是100%。

这是我的整个CDK管道：

import * as path from "path";
import {Construct} from "constructs"
import * as pipelines from "aws-cdk-lib/pipelines"
import * as cdk from "aws-cdk-lib"
import * as s3 from "aws-cdk-lib/aws-s3"
import * as s3d from "aws-cdk-lib/aws-s3-deployment"
import * as iam from "aws-cdk-lib/aws-iam"
import * as route53 from "aws-cdk-lib/aws-route53";
export class MainStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
const bucket = new s3.Bucket(this, "Bucket", {
websiteIndexDocument: "index.html",
websiteErrorDocument: "error.html",
publicReadAccess: true,
})
const dnsZone = route53.HostedZone.fromLookup(this, "DNS zone", {domainName: "example.com"})
new route53.CnameRecord(this, "cname", {
zone: dnsZone,
recordName: "staging",
domainName: bucket.bucketWebsiteDomainName
})
new s3d.BucketDeployment(this, "WebsiteDeployment", {
sources: [s3d.Source.asset(path.join(process.cwd(), "../build"))],
destinationBucket: bucket
})
}
}
export class DeployStage extends cdk.Stage {
public readonly mainStack: MainStack
constructor(scope: Construct, id: string, props?: cdk.StageProps) {
super(scope, id, props)
this.mainStack = new MainStack(this, "MainStack", {env: props?.env})
}
}
export interface PipelineStackProps extends cdk.StackProps {
readonly githubRepo: string
readonly repoBranch: string
readonly repoConnectionArn: string
}
export class PipelineStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: PipelineStackProps) {
super(scope, id, props)
const pipeline = new pipelines.CodePipeline(this, id, {
pipelineName: id,
synth: new pipelines.CodeBuildStep("Synth", {
input: pipelines.CodePipelineSource.connection(props.githubRepo, props.repoBranch, {connectionArn: props.repoConnectionArn}),
installCommands: [
"npm install -g aws-cdk"
],
commands: [
// First build the React app.
"npm ci",
"npm run build",
// Now build the CF stack.
"cd infra",
"npm ci",
"npx cdk synth"
],
primaryOutputDirectory: "infra/cdk.out",
rolePolicyStatements: [
new iam.PolicyStatement({
actions: ["route53:ListHostedZonesByName"],
resources: ["*"],
effect: iam.Effect.ALLOW
})
]
},
),
})

const deploy = new DeployStage(this, "Staging", {env: props?.env})
const deployStage = pipeline.addStage(deploy)
}
}

Answer 1

如果synth阶段出现故障，则不能依赖CDK管道自行修复，因为pipeline CloudFormation Stack在SelfMutate阶段中发生了更改，该阶段使用synth阶段的输出。你需要做以下选项之一来修复你的管道：

1. 在本地运行cdk synth和cdk deploy PipelineStack(或管道之外的任何地方，在那里您具有所需的AWS IAM权限(编辑：您需要将selfMutation临时设置为false才能工作(参考(

2. 暂时从MainStack中删除route53.HostedZone.fromLookup和route53.CnameRecord，同时保留rolePolicyStatements的更改。提交并推送您的代码，让CodePipeline运行一次，确保Pipeline自我变异，并且IAM角色具有所需的额外权限。添加回route53构造，提交，再次推送，并检查您的代码是否能适应新的更改。