AWS-CDK管道可以使用多个AWS账户实现CI/CD过程,但是当一些应用程序或服务不再需要时,这些跨账户堆栈需要被删除。为了实现跨账户堆栈删除,可以使用以下步骤:
例如:
const pipelineStack = new CodePipelineStack(app, 'MyPipelineStack', {
env: {
account: PIPELINE_ACCOUNT,
region: PIPELINE_REGION,
},
});
pipelineStack.addPipeline({
...
});
const role = new Role(this, 'PipelineCrossAccountRole', {
assumedBy: new AccountPrincipal(CROSS_ACCOUNT),
});
pipelineStack.pipeline.addToRolePolicy(new PolicyStatement({
effect: Effect.ALLOW,
actions: ['sts:AssumeRole'],
resources: [role.roleArn],
}));
new CfnOutput(this, 'PipelineIAMRoleArn', {
value: role.roleArn,
});
CloudFormationCapabilities.NAMED_IAM以便CDK在受信任的账户中创建新的IAM角色。例如:
const app = new App();
const stack = new Stack(app, 'CrossAccountStackRemovalStack', {
env: {
account: CROSS_ACCOUNT,
region: CROSS_REGION,
},
// Required to create an IAM role for cross-account stack removal.
// We are using `STRICT` because a cross-account IAM role is created and its permissions
// must be explicitly granted using the pipeline output.
// It is not necessary to use STRICT if your stack does not create new IAM roles
// or have other CloudFormation capabilities that require an explicit allow.
stackName: 'CrossAccountStackRemovalStack',
synthesizer: new DefaultStackSynthes