AWS RDS 代理配置

Question

我需要创建一个带有私有子网的 VPC + RDS Postgres DB + RDS 代理，我正在使用无服务器的 CloudFormation 设置所有内容。

我能够配置除 RDS 代理之外的所有内容，当我运行 serverless deploy 时，部署在创建 Target group 时挂起并最终显示超时错误。

这是我在 AWS 控制台中看到的，即使我手动完成了整个过程：

当我运行aws rds describe-db-proxy-targets --db-proxy-name so-proxy-rds-db-proxy 时，我得到了：

{
    "Targets": [
        {
            "Endpoint": "so-proxy-rds-db.csy8ozys6dtv.us-west-2.rds.amazonaws.com",
            "RdsResourceId": "so-proxy-rds-db",
            "Port": 5432,
            "Type": "RDS_INSTANCE",
            "Role": "READ_WRITE",
            "TargetHealth": {
                "State": "UNAVAILABLE",
                "Reason": "AUTH_FAILURE",
                "Description": "Proxy does not have any registered credentials"
            }
        }
    ]
}

但是我可以在 Secrets Manager 中看到它们。这是可重现的配置：

service: so-proxy-rds

frameworkVersion: "=2.49.0"
variablesResolutionMode: 20210326
configValidationMode: error

provider:
  name: aws
  runtime: nodejs14.x
  region: us-west-2
  versionFunctions: false
  memorySize: 1024
  timeout: 30

resources:
  Resources:    
    VPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: 10.0.0.0/16
        EnableDnsSupport: true
        EnableDnsHostnames: true
        Tags:
          - Key: Name
            Value: vpc
          
    PrivateSubnetA:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: 
          Ref: VPC
        CidrBlock: 10.0.2.0/24
        AvailabilityZone:       
          Fn::Select: 
            - 0
            - Fn::GetAZs: ""
        Tags:
          - Key: Name
            Value: private-A

    PrivateSubnetB:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: 
          Ref: VPC
        CidrBlock: 10.0.3.0/24
        AvailabilityZone:       
          Fn::Select: 
            - 1
            - Fn::GetAZs: ""
        Tags:
          - Key: Name
            Value: private-B

    PrivateRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
        VpcId: 
          Ref: VPC
        Tags:
        - Key: Name
          Value: private
    
    PrivateSubnetARouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId: 
          Ref: PrivateSubnetA
        RouteTableId: 
          Ref: PrivateRouteTable

    PrivateSubnetBRouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:
        SubnetId: 
          Ref: PrivateSubnetB
        RouteTableId: 
          Ref: PrivateRouteTable
      
    OpenSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties: 
        GroupDescription: 'Open firewall'
        GroupName: ${self:service}-open
        SecurityGroupEgress: 
          - CidrIp: 0.0.0.0/0
            IpProtocol: "-1"
        SecurityGroupIngress: 
          - CidrIp: 0.0.0.0/0
            IpProtocol: "-1"
        VpcId: 
          Ref: VPC

    DBSubnetGroup:
      Type: AWS::RDS::DBSubnetGroup
      Properties:
        DBSubnetGroupDescription: DB subnet group
        SubnetIds:
          - Ref: PrivateSubnetA
          - Ref: PrivateSubnetB

    PostgresDB:
      Type: AWS::RDS::DBInstance
      Properties:
        DBInstanceIdentifier: db
        DBName: test_db
        AllocatedStorage: 20
        DBInstanceClass: db.t2.micro
        DBSubnetGroupName: 
          Ref: DBSubnetGroup
        Engine: postgres
        EngineVersion: 11.12 # only up to version 11 supports proxy
        MasterUsername: test_user
        MasterUserPassword: test_pass
        PubliclyAccessible: false
        VPCSecurityGroups:
          - Ref: OpenSecurityGroup
      DeletionPolicy: Delete

    ProxySecretValues:
      Type: 'AWS::SecretsManager::Secret'
      Properties:
        Name: proxy-secrets
        SecretString: '{"username":"test_user","password":"test_pass"}'

    DBProxy:
      Type: AWS::RDS::DBProxy
      Properties:
        DBProxyName: db-proxy
        EngineFamily: POSTGRESQL
        RoleArn:
          Fn::GetAtt:
            - DBProxyRole
            - Arn
        Auth:
          - AuthScheme: SECRETS
            IAMAuth: DISABLED
            SecretArn:
              Ref: ProxySecretValues
        VpcSubnetIds:
          - Ref: PrivateSubnetA
          - Ref: PrivateSubnetB
        VpcSecurityGroupIds:
          - Ref: OpenSecurityGroup

    DBProxyTargetGroup:
      Type: "AWS::RDS::DBProxyTargetGroup"
      Properties:
        DBInstanceIdentifiers:
          - Ref: PostgresDB
        DBProxyName: 
          Ref: DBProxy
        TargetGroupName: default

    DBProxyRole:
      Type: "AWS::IAM::Role"
      Properties:
        AssumeRolePolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Principal:
                Service:
                  - "rds.amazonaws.com"
              Action:
                - "sts:AssumeRole"
        ManagedPolicyArns:
          - Ref: DBProxyPolicy
        RoleName: db-proxy-role

    DBProxyPolicy:
      Type: "AWS::IAM::ManagedPolicy"
      Properties:
        ManagedPolicyName: db-proxy-policy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: Allow
              Action:
                - "secretsmanager:*"
              Resource: '*'
            - Effect: Allow
              Action:
                - "kms:*"
              Resource: '*'

非常感谢任何帮助，谢谢。

Answer 1

我没有看到您的“DBProxy”资源中声明的 roleArn 条目的角色。

查看文档：

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-rds-dbproxy.html?icmpid=docs_cfn_console_designer

注意下面CF sn-p中的“RoleArn”：

"Resources": {
    "TestDBProxy": {
        "Type": "AWS::RDS::DBProxy",
        "Properties": {
            "DebugLogging": true,
            "DBProxyName": {
                "Ref": "ProxyName"
            },
            "EngineFamily": "MYSQL",
            "IdleClientTimeout": 120,
            "RequireTLS": true,
            "RoleArn": {
                "Ref": "BootstrapSecretReaderRoleArn"
            },
            "Auth": [
                {
                    "AuthScheme": "SECRETS",
                    "SecretArn": {
                        "Ref": "BootstrapProxySecretArn"
                    },
                    "IAMAuth": "DISABLED"
                }
            ],
            "VpcSubnetIds": {
                "Fn::Split": [
                    ",",
                    {
                        "Ref": "SubnetIds"
                    }
                ]
            }
        }
    }