amazon-web-services - CdkPipeline - 手动 S3 工件存储桶/角色分配失败

Question

我正在根据此处的 CDK Workshop 示例进行简单的 CDK 管道部署：https ://cdkworkshop.com/20-typescript/70-advanced-topics/200-pipelines/4000-build-stage.html 。基础项目构建没有问题，我已经成功地将我们自己的堆栈代码移植到项目中，通过将 crossAccountKeys 设置为 false 来禁用 KMS。为了使管道资源更易于管理，我尝试手动将共享的 S3 工件存储桶分配给管道。这会产生以下错误：

权限不足 - 服务角色或操作角色没有访问名为 cdktestbucketforpipeline 的 Amazon S3 存储桶所需的权限。更新 IAM 角色权限，然后重试。错误：Amazon S3:AccessDenied:Access Denied（服务：Amazon S3；状态码：403…</p>

共享存储桶有一个允许所有服务访问的策略。为了解决这个错误，我尝试手动为管道分配一个角色。最初我创建了一个受限角色，然后分配了管理员权限，然后是高级用户。我在某处读到管理员角色不能担任角色，因为它是管理员。对于这些任务中的每一个，我都会收到以下错误：

arn:aws:iam:: 012345678910:role/PipelineDeployingLambdaStack-PipelineRoleB27FAA37-1FWCSUUPOC8T8 无权对角色执行 AssumeRole arn:aws:iam:: 012345678910:role/PipelineDeployingLambdaSt-PipelineAssetsFileRole59-DBZ4RKIOSURN

对于上下文，这是在 PipelineStack 类之后的代码摘录，我在其中添加了存储桶和角色：

// The basic pipeline declaration. This sets the initial structure
    // of our pipeline
    const pipeline = new CdkPipeline(this, 'Pipeline', {
        pipelineName: 'WorkshopPipeline',
        cloudAssemblyArtifact,

        crossAccountKeys: false,
        // Generates the source artifact from the repo we created in the last step
        sourceAction: new codepipeline_actions.CodeCommitSourceAction({
            actionName: 'CodeCommit', // Any Git-based source control
            output: sourceArtifact, // Indicates where the artifact is stored
            repository: repo // Designates the repo to draw code from
        }),

        // Builds our source code outlined above into a could assembly artifact
        synthAction: SimpleSynthAction.standardNpmSynth({
            sourceArtifact: sourceArtifact, // Where to get source code to build
            cloudAssemblyArtifact: cloudAssemblyArtifact, // Where to place built source

            buildCommand: 'npm run build', // Language-specific build cmd
            environment : {
              buildImage: LinuxBuildImage.STANDARD_4_0,
              privileged: true
            }
        })
    });
pipeline.codePipeline.artifactBucket = Bucket.fromBucketName(this, 'S3ArtifactBucket', 'cdktestbucketforpipeline');
pipeline.codePipeline.role = Role.fromRoleArn(this, 'CDKS3TestRole', 'arn:aws:iam::012345678910:role/CDKS3Test');
const deploy = new WorkshopPipelineStage(this, 'Deploy');
pipeline.addApplicationStage(deploy);

标签： amazon-web-servicescontinuous-integrationaws-cdk