设置AWS Kinesis cloudformation模板

Question

我是AWS Cloudformation的新手，需要创建Kinesis数据流，然后使用python代码将记录写入此流。 我能够通过cloudformation模板创建数据流，但无法设置权限。 我将如何附加权限以允许某些用户组使用python库写入此运动数据流？

我当前的模板代码是

AWSTemplateFormatVersion: '2010-09-09'
Description: 'This template will create an AWS Kinesis DataStream'

Parameters:

CFNStreamName:
    Description: This will be used to name the Kinesis DataStream
    Type: String
    Default: 'data-stream'

CFNRetensionHours:
    Description: This will be used to set the retension hours
    Type: Number
    Default: 168

CFNShardCount:
    Description: This will be used to set the shard count
    Type: Number
    Default: 2

Resources:
    MongoCDCStream:
Type: AWS::Kinesis::Stream
Properties:
  Name: !Ref CFNStreamName
  RetentionPeriodHours: !Ref CFNRetensionHours
  ShardCount: !Ref CFNShardCount
  StreamEncryption:
      EncryptionType: KMS
      KeyId: alias/aws/kinesis
Outputs:
    MongoCDCStream:
    Value: !Ref MongoCDCStream
    Export:
        Name: !Sub ${AWS::StackName}-MongoCDCStream

Answer 1

您将要（通过cloudformation参数）传递运行Python代码的IAM角色或用户。

在模板内，创建一个IAM策略或ManagedPolicy，该策略或策略附加到您传入的IAM角色/用户上，并分配正确的权限。

AWSTemplateFormatVersion: '2010-09-09'
Description: 'This template will create an AWS Kinesis DataStream'

Parameters:

CFNStreamName:
    Description: This will be used to name the Kinesis DataStream
    Type: String
    Default: 'data-stream'

CFNRetensionHours:
    Description: This will be used to set the retension hours
    Type: Number
    Default: 168

CFNShardCount:
    Description: This will be used to set the shard count
    Type: Number
    Default: 2

PythonCodeRole:
    Type: String
# ^- Pass in role here.

Resources:
    # Assign permission here.
    PythonCodePlicyAssignmen:
        Type: AWS::IAM::Policy
        Properties: 
            PolicyDocument: 
                <assign needed permission here>
                Version: "2012-10-17"
                Statement:
                  - Effect: "Allow"
                    Action:
                      - "kinesis:*"
                    Resource: !Ref MongoCDCStream
                    # ^- here, use !Ref to tie in the correct resource id cleanly.
            PolicyName: python-code-permission
            Roles: [!Ref PythonCodeRole]

    MongoCDCStream:
        Type: AWS::Kinesis::Stream
        Properties:
            Name: !Ref CFNStreamName
            RetentionPeriodHours: !Ref CFNRetensionHours
            ShardCount: !Ref CFNShardCount
            StreamEncryption:
              EncryptionType: KMS
              KeyId: alias/aws/kinesis
Outputs:
    MongoCDCStream:
    Value: !Ref MongoCDCStream
    Export:
        Name: !Sub ${AWS::StackName}-MongoCDCStream