AWS：Cloudformation腳本創建基於條件語句的CloudTrail S3存儲

Question

我想創建一個CloudFormation腳本，使CloudTrail，並給用戶提供一個選項來創建新的S3存儲和使用，或者使用現有S3桶。我是AWS的新手，所以我有點迷路。這裏是我已經採取和修改的一些代碼，迄今爲止沒有添加條件等。

{ 
"AWSTemplateFormatVersion" : "2010-09-09", 
"Description" : "CloudTrail", 
"Parameters" : { 
    "UseExisitingBucket" : { 
     "Description" : "Yes/No", 
     "Default" : "Yes", 
     "Type" : "String", 
     "AllowedValues" : [ "yes", "no"] 
    }, 
    "BucketName" : { 
     "Description" : "Name of the S3 bucket.", 
     "Type" : "String" 
    }, 
    "TopicName" : { 
     "Description" : "Name of the SNS topic.", 
     "Type" : "String", 
     "Default" : "" 
    }, 
    "IncludeGlobalServiceEvents" : { 
     "Description" : "Indicates whether the trail is publishing events from global services, such as IAM, to the log files.", 
     "Type" : "String", 
     "Default" : "false", 
     "AllowedValues" : [ 
      "true", 
      "false" 
     ] 
    } 
}, 
"Conditions" : { 
    "UseSNSTopic" : { 
     "Fn::Not" : [ 
      { 
       "Fn::Equals" : [ 
        { 
         "Ref" : "TopicName" 
        }, 
        "" 
       ] 
      } 
     ] 
    } 
}, 
"Resources" : { 
    "Trail" : { 
     "Type" : "AWS::CloudTrail::Trail", 
     "Properties" : { 
      "IncludeGlobalServiceEvents" : { 
       "Ref" : "IncludeGlobalServiceEvents" 
      }, 
      "S3BucketName" : { 
       "Ref" : "BucketName" 
      }, 
      "SnsTopicName" : { 
       "Fn::If" : [ 
        "UseSNSTopic", 
        { 
         "Ref" : "TopicName" 
        }, 
        { 
         "Ref" : "AWS::NoValue" 
        } 
       ] 
      }, 
      "IsLogging" : true 
     } 
    } 
} 

}

Answer 1

你很接近，我會建議，刪除UseExisitingBucket參數。然後加入Default到BucketName所以它會是這個樣子：檢查

"ExistingBucketName" : { 
    "Description" : "Name of the S3 bucket.", 
    "Type" : "String", 
    "Default": "None" 
}, 

添加幾個條件，如果提供水桶，或者如果你需要創建新的一個：

"Conditions": { 
    "CreateNewBucket": { 
     "Fn::Equals": [ 
      { 
       "Ref": "ExistingBucketName" 
      }, 
      "None" 
     ] 
    }, 
    "UseExistingBucket": { 
     "Fn::Not": [ 
      { 
       "Fn::Equals": [ 
        { 
         "Ref": "ExistingBucketName" 
        }, 
        "None" 
       ]     
      } 
     ] 
    } 
} 

然後創建S3存儲資源與以上條件類似：

"S3Bucket": { 
    "Condition": "CreateNewBucket", 
    ... 
    ... 

} 

添加2個雲軌資源與「CreateNewBucket」條件之一，並通過「S3Bucket」資源，另一種以「UseExistingBucket」，並通過「ExistingBucketName」