具有IAC角色以終止該Cloudformation堆棧的EC2實例的AWS Cloudformation模板

Question

我想創建一個可終止的Cloudformation堆棧以運行批處理作業，此作業此後終止。 所以我想要一個具有IAM角色的EC2實例的Cloudformation模板來終止該Cloudformation堆棧。

Answer 1

這裏有一個最小的CloudFormation運行aws cloudformation delete-stack堆棧的EC2實例自毀：

Description: Cloudformation stack that self-destructs 
Mappings: 
    # amzn-ami-hvm-2016.09.1.20161221-x86_64-gp2 
    RegionMap: 
    us-east-1: 
     "64": "ami-9be6f38c" 
Resources: 
    EC2Role: 
    Type: AWS::IAM::Role 
    Properties: 
     RoleName: !Sub "EC2Role-${AWS::StackName}" 
     AssumeRolePolicyDocument: 
     Version: 2012-10-17 
     Statement: 
     - Effect: Allow 
      Principal: 
      Service: [ ec2.amazonaws.com ] 
      Action: [ "sts:AssumeRole" ] 
     Path:/
     Policies: 
     - PolicyName: EC2Policy 
     PolicyDocument: 
      Version: 2012-10-17 
      Statement: 
      - Effect: Allow 
      Action: 
      - "cloudformation:DeleteStack" 
      Resource: !Ref "AWS::StackId" 
      - Effect: Allow 
      Action: [ "ec2:TerminateInstances" ] 
      Resource: "*" 
      Condition: 
       StringEquals: 
       "ec2:ResourceTag/aws:cloudformation:stack-id": !Ref AWS::StackId 
      - Effect: Allow 
      Action: [ "ec2:DescribeInstances" ] 
      Resource: "*" 
      - Effect: Allow 
      Action: 
      - "iam:RemoveRoleFromInstanceProfile" 
      - "iam:DeleteInstanceProfile" 
      Resource: !Sub "arn:aws:iam::${AWS::AccountId}:instance-profile/*" 
      - Effect: Allow 
      Action: 
      - "iam:DeleteRole" 
      - "iam:DeleteRolePolicy" 
      Resource: !Sub "arn:aws:iam::${AWS::AccountId}:role/EC2Role-${AWS::StackName}" 
    RootInstanceProfile: 
    Type: AWS::IAM::InstanceProfile 
    Properties: 
     Path:/
     Roles: [ !Ref EC2Role ] 
    WebServer: 
    Type: AWS::EC2::Instance 
    Properties: 
     ImageId: !FindInMap [ RegionMap, !Ref "AWS::Region", 64 ] 
     InstanceType: m3.medium 
     IamInstanceProfile: !Ref RootInstanceProfile 
     UserData: 
     "Fn::Base64": 
      !Sub | 
      #!/bin/bash 
      aws cloudformation delete-stack --stack-name ${AWS::StackId} --region ${AWS::Region} 

請注意，如果您有任何附加的資源，你需要添加相應的'刪除'對EC2Policy聲明列表的IAM權限。