堆棧內存溢出
  簡體   English   中英

獲取Cloudformation錯誤：未成功創建嵌入式堆棧

[英]Getting Cloudformation error: Embedded stack was not successfully created

 原文  2018-03-13 20:30:24  9   1    amazon-web-services/ templates/ nested/ stack/ amazon-cloudformation

問題描述

我已經制作了一個引用4個子模板的父（嵌套）堆棧模板。 當我通過aws cloudformation create-stack啟動aws cloudformation create-stack ，我得到父堆棧的以下錯誤：

Embedded stack AlignmentLambdaFunction was not successfully created: The following resource(s) failed to create: [CloudspanLambdaFunction, HaploLambdaExecutionRole, AlignmentLambdaExecutionRole].

我在其中一個從父級創建的嵌套堆棧中收到此錯誤： Policy contains a statement with one or more invalid principals （對於MasterGCPStorageKey（上面是Lambda子級中的資源）

我不明白錯誤的來源。 我想也許是因為需要DependsOn來執行ExecutionRoles，但是這並沒有解決錯誤。

父堆棧 ： 

AWSTemplateFormatVersion: "2010-09-09"
Description: "Master template for wgs-pipeline. Calls to other stack templates."
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
  AlignmentLambdaFuncS3KeyName:
    Type: String
  AlignmentLambdaFuncModuleName:
    Type: String
  HaploLambdaFuncS3BucketName:
    Type: String
  HaploLambdaFuncS3KeyName:
    Type: String
  HaploLambdaFuncModuleName:
    Type: String
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Ref: 'VPC'
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: 
        Ref: 'VPC'
      InternetGatewayId: 
        Ref: 'InternetGateway'
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Security Group for instances launched in the VPC by Batch
      VpcId: 
        Ref: 'VPC'
  StepFunctionsActivitiesInstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow http to client host
      VpcId:
        Ref: VPC
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: 128.218.0.0/16
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/24
      VpcId: 
        Ref: 'VPC'
      AvailabilityZone: 
        Ref: GPCESubnetAZ1
      MapPublicIpOnLaunch: 'True'
    DependsOn: VPC

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: 
        Ref: 'InternetGateway'
    DependsOn:
      - RouteTable
      - InternetGateway
  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: 
        Ref: 'RouteTable'
      SubnetId: 
        Ref: 'Subnet'
    DependsOn:
      - RouteTable
      - Subnet

  # Beginning of reference to child stacks

  ClouspanLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        CloudspanLambdaFuncS3BucketName: 
          Ref: CloudspanLambdaFuncS3BucketName
        CloudspanLambdaFuncS3KeyName: 
          Ref: CloudspanLambdaFuncS3KeyName
        CloudspanLambdaFuncModuleName: 
          Ref: CloudspanLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  AlignmentLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        AlignmentLambdaFuncS3BucketName: 
          Ref: AlignmentLambdaFuncS3BucketName
        AlignmentLambdaFuncS3KeyName: 
          Ref: AlignmentLambdaFuncS3KeyName
        AlignmentLambdaFuncModuleName: 
          Ref: AlignmentLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

  HaploLambdaFunction:
    Type: "AWS::CloudFormation::Stack"
    Properties:
      Parameters:
        HaploLambdaFuncS3BucketName: 
          Ref: HaploLambdaFuncS3BucketName
        HaploLambdaFuncS3KeyName: 
          Ref: HaploLambdaFuncS3KeyName
        HaploLambdaFuncModuleName: 
          Ref: HaploLambdaFuncModuleName
        KMSAdminUserARN: 
          Ref: KMSAdminUserARN
        KMSEndUserARN: 
          Ref: KMSEndUserARN
      TemplateURL: https://s3.amazonaws.com/CFNTemplate/lambda_resources.stack.yaml
      TimeoutInMinutes: 1

Lambda Child Stack（與錯誤相關） ： 

AWSTemplateFormatVersion: '2010-09-09'
Description: lambda function and execution role stack.
Parameters:
  CloudspanLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  CloudspanLambdaFuncS3KeyName:
    Default: 'sfn.deployable.zip'
    Type: String
  CloudspanLambdaFuncModuleName:
    Default: 'cloudspan'
    Type: String
  AlignmentLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  AlignmentLambdaFuncS3KeyName:
    Type: String
    Default: 'alignment_processing.deployable.zip'
  AlignmentLambdaFuncModuleName:
    Type: String
    Default: 'alignment_processing'
  HaploLambdaFuncS3BucketName:
    Type: String
    Default: 'claudia-test-transfer'
  HaploLambdaFuncS3KeyName:
    Type: String
    Default: 'sentieon_haplotyper.deployable.zip'
  HaploLambdaFuncModuleName:
    Type: String
    Default: 'sentieon_haplotyper'
  KMSAdminUserARN:
    Type: String
  KMSEndUserARN:
    Type: String


Resources:

  CloudspanLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: CloudspanLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: CloudspanLambdaFuncS3BucketName
        S3Key:
          Ref: CloudspanLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: CloudspanLambdaExecutionRole

  AlignmentLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: AlignmentLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ AlignmentLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: AlignmentLambdaFuncS3BucketName
        S3Key:
          Ref: AlignmentLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: AlignmentLambdaExecutionRole

  HaploLambdaFunction:
    Type: "AWS::Lambda::Function"
    Properties:
      Handler:
        Fn::Join: [ ".", [ Ref: HaploLambdaFuncModuleName, "handler"] ]
      Role:
        Fn::GetAtt: [ HaploLambdaExecutionRole, Arn ]
      Code:
        S3Bucket:
          Ref: HaploLambdaFuncS3BucketName
        S3Key:
          Ref: HaploLambdaFuncS3KeyName
      Runtime: "python3.6"
      Timeout: "60"
    DependsOn: HaploLambdaExecutionRole


  CloudspanLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*


  AlignmentLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  HaploLambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: CanListBuckets
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "s3:GetBucketLocation"
                  - "s3:ListAllMyBuckets"
                Resource: "arn:aws:s3:::*"
        - PolicyName: CanCallBatch
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - "batch:*"
                Resource: "*"
        - PolicyName: CanLog
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
            - Effect: Allow
              Action:
              - logs:*
              Resource: arn:aws:logs:*:*:*

  MasterGCPStorageKey:
    Type: "AWS::KMS::Key"
    Properties:
      Description: Symmetric Master Key for GCP Storage Credentials off-line encryption/on-line decryption protocol
      Enabled: True
      EnableKeyRotation: True
      KeyPolicy:
        Version: "2012-10-17"
        Statement:
        - Sid: "Allow Lambda Excution Role access to GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of CloudspanLambdaExecutionRole
            AWS:
              Fn::GetAtt: [ CloudspanLambdaExecutionRole, Arn ]
          Action:
            - kms:Decrypt
            - kms:DescribeKey
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow Administrator to admin the GCP Storage decryption key"
          Effect: "Allow"
          Principal:
            # ARN of the KMS admin IAM user
            AWS:
              Ref: KMSAdminUserARN
          Action:
            - "kms:Create*"
            - "kms:Describe*"
            - "kms:Enable*"
            - "kms:List*"
            - "kms:Put*"
            - "kms:Update*"
            - "kms:Revoke*"
            - "kms:Disable*"
            - "kms:Get*"
            - "kms:Delete*"
            - "kms:TagResource"
            - "kms:UntagResource"
            - "kms:ScheduleKeyDeletion"
            - "kms:CancelKeyDeletion"
            - "kms:Encrypt"
            - "kms:Decrypt"
            - "kms:ReEncrypt"
            - "kms:GenerateDataKey*"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
        - Sid: "Allow End User to encrypt the GCP Storage creds"
          Effect: "Allow"
          Principal:
            # ARN of the KMS IAM end user
            AWS:
              Ref: KMSEndUserARN
          Action:
            - "kms:Encrypt"
            - "kms:ReEncrypt"
            - "kms:DescribeKey"
          # in this context "*" means "this" CMK
          Resource: "*"
    DependsOn: CloudspanLambdaExecutionRole

1 個解決方案

解決方案1
 7  2018-05-17 19:27:12

在重新部署我刪除的CloudFormation堆棧后，我也遇到了以下錯誤（通過無服務器）： 

We encountered the following errors while processing your request:
Policy contains a statement with one or more invalid principals.

就我而言，已刪除分配給我的KMS加密密鑰的原始角色。 KMS仍然保留對已刪除角色的引用，顯然添加新創建的相同類型的角色會產生此錯誤。

我通過在IAM > Encryption Keys > YOUR_KEY_NAME > Key Policy > Key Users下刪除對已刪除角色的舊引用解決了這個問題

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 發生錯誤：APINestedStack - 未成功創建嵌入式堆棧 XYZ：以下資源無法創建：[...] AWS - CloudFormation 返回堆棧已存在異常並且未能更新到 DynamoDB，盡管堆棧已成功創建 SDK無法看到已創建的CloudFormation堆棧 為什么未在 CloudFormation Stack 中創建此安全組？ cloudformation堆棧中的內部轉換錯誤 具有 Cloudfront 部署的 Cloudformation 堆棧獲取失敗的來源 AWS CLI cloudformation 驗證模板成功，但在創建堆棧期間出錯 在 AWS cloudformation 上理解 Apigateway 和嵌套堆棧時出錯 AWS Cloudformation 創建堆棧模板錯誤 嵌套 Cloudformation 堆棧中的 CFN-Lint 錯誤
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM