尝试跨区域部署时出现AWS codepipeline错误

Question

我有一个AWS管理帐户和一个开发帐户。

我从管理层那里运行我的管道，它将资源部署到欧盟-西部-2和美国-东部-1地区的开发中。

由于某些原因，我在部署时遇到此错误。

项目源项目复制失败:无法将项目从eu-west-2中的bucketA复制到us-east-1中的BucketB :提供的KMS ARN无效：'Invalid arn s3‘。

我已经三次检查了我在pipeline_artefact_kms_key中使用的arns，这似乎是正确的。

下面是我的一些代码片段。

​

Resources:
  CodePipeline:
    Type: AWS::CodePipeline::Pipeline
    Properties:
      Name: "somepipeline"
      ArtifactStores:
        - Region: eu-west-2
          ArtifactStore:
            EncryptionKey:
              Type: KMS
              Id: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/artefact_encryption_key/arn:1}}"
            Location: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/build_bucket/name:1}}"
            Type: S3
        - Region: us-east-1
          ArtifactStore:
            EncryptionKey:
              Type: KMS
              Id: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/mgmt/us-east-1/pipeline_artefact_kms_key/arn:1}}"
            Location: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/mgmt/us-east-1/build_bucket/name:1}}"
            Type: S3
      RoleArn: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/pipeline_role_arn/mgmt:1}}"
      Stages:
        - Name: GetSource
          Actions:
            - Name: FetchProjectPipelineCode
              ActionTypeId:
                Category: Source
                Owner: ThirdParty
                Version: 1
                Provider: GitHub
              Configuration:
                Owner: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/github/organisation:1}}"
                Repo: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/github/repository:1}}"
                PollForSourceChanges: 'false'
                Branch:
                  Ref: BranchToBuild
                OAuthToken: !Sub "{{resolve:secretsmanager:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/github/oauth_token:SecretString:token}}"
              OutputArtifacts:
                - Name: project-source
              RunOrder: 1
        - Name: DeployAuthLambdasToDev
          Actions:
            - Name: DeployLambdas-dev
              RoleArn: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/pipeline_role_arn/dev:1}}"
              ActionTypeId:
                Category: Deploy
                Owner: AWS
                Version: '1'
                Provider: CloudFormation
              InputArtifacts:
                - Name: project-source
              OutputArtifacts:
                - Name: lambdas_outputs_dev
              Configuration:
                ActionMode: REPLACE_ON_FAILURE
                Capabilities: CAPABILITY_NAMED_IAM,CAPABILITY_AUTO_EXPAND
                RoleArn: !Sub "{{resolve:ssm:/${SSMNamespace}/${SystemSSMConfigId}/pipeline/pipeline_role_arn/dev:1}}"
                StackName: !Sub "${UniqueId}-AuthLambdas"
                TemplatePath: project-source::aws/pipeline/us-east-1/dev/lambdas.cf.yaml
                TemplateConfiguration: project-source::aws/pipeline/service_config.json
                OutputFileName: stack_outputs.json
              Region: us-east-1
              RunOrder: 1

​

Answer 1

更新：

我设法解决了这个问题，这与ARN有关。由于某些原因，SSM无法正确解析它。我不确定为什么我检查SSM时非常注意细节，包括版本号！