如何解決 CloudFormation 中使用 AWS 無伺服器應用程式模型 (SAM) 範本時的循環相依性?

2 分的閱讀內容
0

如果我在 AWS CloudFormation 中部署 AWS 無伺服器應用程式模型 (SAM) 範本,會收到類似以下內容的錯誤: 「在以下資源之間的循環相依性:[Function、Bucket、FunctionRole、FunctionUploadPermission]。」

簡短描述

如果您使用下列範例 AWS SAM 範本,則會在 CloudFormation 中收到錯誤:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Circular Dependency
Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "{AWS::StackName}-${AWS::Region}-${AWS::AccountId}"
  Function:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://mybucket/function.zip
      Runtime: nodejs12.x
      Handler: index.handler
      Policies:
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action: s3:GetObject*
              Resource: !Sub "arn:aws:s3:::${Bucket}*"
      Events:
        Upload:
          Properties:
            Bucket:
              Ref: Bucket
            Events: s3:ObjectCreated:*
          Type: S3

此範本會發生錯誤,因為其會產生下列循環相依性:

  1. 儲存貯體資源依賴於 FunctionUploadPermission
  2. FunctionUploadPermission 依賴於 Function
  3. Function 依賴於 FunctionRole
  4. FunctionRole 依賴於儲存貯體資源,而產生一個迴圈。

注意: 在錯誤訊息中,FunctionUploadPermission 資源的類型是 AWS::Lambda::Permission。 指定 AWS::Serverless::FunctionEvents 屬性時,AWS SAM 會自動產生此資源。FunctionRole 資源的類型是 ** AWS::IAM::Role**。未指定 AWS::Serverless::FunctionRole 屬性時,AWS SAM 會自動產生此資源。

若要解決循環相依性,您必須替換儲存貯體資源的動態參照來中斷迴圈。

解決方法

使用下列範本替換具有循環相依性的 CloudFormation 範本:

Permission is hereby granted, free of charge, to any person obtaining a copy of this
software and associated documentation files (the "Software"), to deal in the Software
without restriction, including without limitation the rights to use, copy, modify,
merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Circular Dependency
Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${AWS::StackName}-${AWS::Region}-${AWS::AccountId}"
  Function:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: s3://mybucket/function.zip
      Runtime: nodejs12.x
      Handler: index.handler
      Policies:
        - Version: 2012-10-17
          Statement:
            - Effect: Allow
              Action: s3:GetObject*
              Resource: !Sub "arn:aws:s3:::${AWS::StackName}-${AWS::Region}-${AWS::AccountId}*"
      Events:
        Upload:
          Properties:
            Bucket:
              Ref: Bucket
            Events: s3:ObjectCreated:*
          Type: S3

在此範本中,政策陳述式 Resources (資源) 區段中的儲存貯體名稱,會使用儲存貯體資源 BucketName 屬性中使用的相同虛擬參數。您現在可以傳遞儲存貯體名稱,而不需直接參照該儲存貯體。循環相依性迴圈會中斷,因而解決此錯誤。也就是說,依賴於儲存貯體資源的 FunctionRole 會造成此循環相依性迴圈。

**注意:**將 s3://mybucket/function.zip 替換為檔案位置。


相關資訊

Fn::Sub (內部函數)

Ref (內部函數)

AWS::Serverless::Function

AWS::S3::Bucket

AWS 官方
AWS 官方已更新 2 年前