CloudFormation 一致性包

Question

我尝试通过 Cloudformation 使用 AWS 一致性包。我创造了一些非常简单的东西：

以下堆栈创建一个 S3 存储桶 + 一致性包。然后我将 Conformance Pack 的模板存储到另一个 S3 存储桶（后一个脚本）：

AWSTemplateFormatVersion: '2010-09-09'
Description: Conformancepack Stack
Parameters:
  ZipBucketParam:
    Description: bucket name
    Type: String
  TemplateBucket:
    Description: bucket name
    Type: String
Resources:
  ZipBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub ${ZipBucketParam}
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  ZipzapBucketBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
        Ref: "ZipBucket"
      PolicyDocument:
        Statement:
          -
            Sid: "AWSConfigConformsCheckAcls"
            Action:
              - "s3:GetBucketAcl"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                  - "arn:aws:s3:::"
                  -
                    Ref: "ZipBucket"
            Principal:
              AWS:
                - !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms"
            Condition:
              Bool:
                aws:SecureTransport: "true"
          -
            Sid: "AWSConfigConformsWriteBucket"
            Action:
              - "s3:PutObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                  - "arn:aws:s3:::"
                  -
                    Ref: "ZipBucket"
                  - "/AWSLogs/"
                  - Fn::Sub: ${AWS::AccountId}
                  - "/Config/*"
            Principal:
              AWS:
                - !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms"
            Condition:
              StringEquals:
                s3:x-amz-acl: "bucket-owner-full-control"
              Bool:
                aws:SecureTransport: "true"
          -
            Sid: "AWSConfigConformsBucketRead"
            Action:
              - "s3:GetObject"
            Effect: "Allow"
            Resource:
              Fn::Join:
                - ""
                  - "arn:aws:s3:::"
                  -
                    Ref: "ZipBucket"
                  - "/AWSLogs/"
                  - Fn::Sub: ${AWS::AccountId}
                  - "/Config/*"
            Principal:
              AWS:
                - !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config-conforms.amazonaws.com/AWSServiceRoleForConfigConforms"
            Condition:
              Bool:
                aws:SecureTransport: "true"
          -
            Action:
              - "*"
            Effect: "Deny"
            Resource:
              Fn::Join:
                - ""
                -
                  - "arn:aws:s3:::"
                  -
                    Ref: "ZipBucket"
                  - "/*"
            Principal: "*"
            Condition:
              Bool:
                aws:SecureTransport: "false"

  FirstConformancePack:
    Type: AWS::Config::ConformancePack
    Properties:
      ConformancePackName: first-conformance-pack
      DeliveryS3Bucket: !Sub s3://${ZipBucket}
      TemplateS3Uri: !Sub s3://${TemplateBucket}/conformance.yaml

conf 包的模板是这样的：

     S3BucketSSLRequestsOnly:
  Type: AWS::Config::ConfigRule
  Properties:
   ConfigRuleName: data-in-transit-s3-bucket-ssl-requests-only
   Scope:
      ComplianceResourceTypes:
        - "AWS::S3::Bucket"
   Source:
    Owner: AWS
    SourceIdentifier: "S3_BUCKET_SSL_REQUESTS_ONLY"

我在下面遇到错误。有什么想法我在这里做错了吗？源 S3 的存储桶策略与我在此堆栈中创建的相同。

“提供的请求无效：在 输入参数无效（Service: Config, Status Code: 400"

Answer 1

嗯，没关系。我显然已经删除了配置规则文件的第一行。显然它应该以“Resources”开头。

Resources:
  S3BucketSSLRequestsOnly:
    Type: AWS::Config::ConfigRule
    Properties:
    .
    .
    .