假设我们有两个AWS账户:Account A和Account B。Account A中有一个Elastic Beanstalk环境,我们希望将它上面的应用程序代码打包并传送到Account B中的S3对象存储桶中,然后由Account B中的CodePipeline流水线进行自动化部署。下面是实现这个过程的几个步骤:
Resources:
CrossAccountRole:
Type: AWS::IAM::Role
Properties:
RoleName: "CrossAccountRole"
AssumeRolePolicyDocument:
Statement:
- Effect: "Allow"
Principal:
AWS: !Ref AccountBARN
Action:
- "sts:AssumeRole"
Policies:
- PolicyName: "AccessS3Bucket"
PolicyDocument:
Statement:
- Effect: Allow
Action:
- "s3:ListBucket"
- "s3:GetBucketLocation"
Resource: !Sub "arn:aws:s3:::${BucketName}"
- Effect: Allow
Action:
- "s3:GetObject"
- "s3:PutObject"
Resource: !Sub "arn:aws:s3:::${BucketName}/*"
Resources:
CodeBuildProject:
Type: "AWS::CodeBuild::Project"
Properties:
Name: "CodeBuildProject"
Artifacts:
Type: "S3"
Location: !Sub "arn:aws:s3:::${BucketName}/"
Environment:
Type: "LINUX_CONTAINER"
ComputeType: "BUILD_GENERAL1_SMALL"
Image: "aws/codebuild/docker:17.09.0"
EnvironmentVariables:
- Name: "S3_BUCKET"
Value: !Sub "${BucketName}"
ServiceRole: !
上一篇:AWS跨账户传递角色不被允许