1

我正在尝试在 CFT 中进行多行替换，但它没有发生。我得到的错误是

An error occurred (ValidationError) when calling the ValidateTemplate operation: Template format error: unsupported structure.

这是非常难以描述的。我有 intellij 的 CFT 插件，它没有给我任何语法错误。支持这样的事情吗？问题线在Fn::Sub

根据本文档，它是。

这是我正在使用的示例。我让整个 CFT 使用硬编码值，但我希望它使用来自 CFT 的导入值，这些值创建了我要查看的堆栈部分

代码：

AWSTemplateFormatVersion: 2010-09-09
Description: "Per ticket: CLOUD-1284"
Parameters:
  LogGroupName:
    Type: String
    Default: "ct/dev-logs"
    AllowedValues: ["ct/dev-logs","ct/prod-logs"]
    Description: Enter CloudWatch Logs log group name. Default is ct/dev-logs

  Email:
    Type: String
    Description: Email address to notify when an API activity has triggered an alarm
    Default: cloudops@
Resources:
  PolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern:
        Fn::Sub:
        - >-
        { ($.eventSource = iam.amazonaws.com) &&
          (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
          (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
        - Ec2Role: !ImportValue infra-Ec2IamRole
        - RdsRole: !ImportValue infra-RdsIamRole

      LogGroupName: !Ref LogGroupName
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: PolicyUpdateMetrics

  PolicyUpdatesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: " Policies have have been updated"
      AlarmActions:
      - Ref: AlarmNotificationTopic
      MetricName: PolicyUpdateMetrics
      Namespace: SpecialMetrics
      Statistic: Sum
      Period: 10
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  S3BucketPolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern: >-
        { ($.eventSource = s3.amazonaws.com) && (($.eventName = Put*) || ($.eventName = Delete*)) &&
        (($.requestParameters.bucketName = assets-us-east-1) || ($.requestParameters.bucketName = logs-us-east-1)) }
      LogGroupName: !Ref LogGroupName
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: S3BucketPolicyUpdateMetric

  S3BucketPolicyUpdatesAlarm:
    Type: AWS::CloudWatch::Alarm
    Properties:
      AlarmDescription: " S3 bucket security settings have been updated"
      AlarmActions:
      - Ref: AlarmNotificationTopic
      MetricName: S3BucketPolicyUpdateMetric
      Namespace: SpecialMetrics
      Statistic: Sum
      Period: 10
      EvaluationPeriods: 1
      Threshold: 1
      ComparisonOperator: GreaterThanOrEqualToThreshold
      TreatMissingData: notBreaching

  AlarmNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
      - Endpoint: !Ref Email
        Protocol: email
4

1 回答 1

3

是的，但您只需要修复语法。

修复：

这是您的代码的简化版本，显示了更正的语法：

---
AWSTemplateFormatVersion: 2010-09-09
Description: Test Stack
Resources:
  PolicyUpdates:
    Type: AWS::Logs::MetricFilter
    Properties:
      FilterPattern:
        Fn::Sub:
        - >-
          { ($.eventSource = iam.amazonaws.com) &&
          (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
          (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
        - {Ec2Role: MyEc2Role, RdsRole: MyRdsRole}
      LogGroupName: !Ref LogGroup
      MetricTransformations:
      - MetricValue: 1
        MetricNamespace: SpecialMetrics
        MetricName: PolicyUpdateMetrics

  LogGroup:
    Type: AWS::Logs::LogGroup

在创建该堆栈时，会创建以下指标过滤器：

▶ aws logs describe-metric-filters --query 'metricFilters[].filterPattern' 
[
    "{ ($.eventSource = iam.amazonaws.com) && (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) && (($.requestParameters.roleName = MyEc2Role) || ($.requestParameters.roleName = MyRdsRole)) }"
]

因此，您需要将您的更改Fn::Sub为：

FilterPattern:
  Fn::Sub:
    - >-
      { ($.eventSource = iam.amazonaws.com) &&
        (($.eventName = Update*) || ($.eventName = Attach*) || ($.eventName = Delete*) || ($.eventName = Detach*) ||($.eventName = Put*)) &&
        (($.requestParameters.roleName = ${Ec2Role}) || ($.requestParameters.roleName = ${RdsRole})) }
    - {Ec2Role: !ImportValue infra-Ec2IamRole, RdsRole: !ImportValue infra-RdsIamRole}

如何获得更好的错误信息：

我做的第一件事是运行 cloudformation validate-template：

▶ aws cloudformation validate-template --template-body file://cloudformation.yml

An error occurred (ValidationError) when calling the ValidateTemplate operation:
  Template format error: YAML not well-formed. (line 23, column 45)

由于这是 YAML 格式问题，因此yamllint实用程序通常会提供更多信息：

▶ yamllint cloudformation.yml 
cloudformation.yml
  23:45     error    syntax error: could not find expected ':'

进入 vim 编辑器并发出命令：

:cal cursor(23,45)

带我到第 23 行第 45 列，在那里我找到了 string 的开头${Ec2Role}。

我看到的第一个问题是缩进是错误的。这实际上是该消息的原因。

通过将第 21-23 行缩进 2 个空格，使模板成为有效的 YAML。然后我从 cloudformation validate-template 得到了更有帮助的回复：

▶ aws cloudformation validate-template --template-body file://cloudformation.yml 

An error occurred (ValidationError) when calling the ValidateTemplate operation:
  Template error: One or more Fn::Sub intrinsic functions don't specify expected
  arguments. Specify a string as first argument, and an optional second argument
  to specify a mapping of values to replace in the string

此时，从文档中可以看出，调用到Fn::Sub语法错误。

于 2019-03-21T03:13:29.680 回答