无法将CodeStarNotification添加到CodePipeline

Question

我用CDK来部署密码。它可以正常工作，直到我尝试添加codepipeline成功/失败事件的通知。它给出了CREATE_FAILED错误的消息Resource handler returned message: "Invalid request provided: AWS::CodeStarNotifications::NotificationRule" (RequestToken: bb566fd0-1ac9-5d61-03fe-f9c27b4196fa, HandlerErrorCode: InvalidRequest)。可能是什么原因？谢谢。

import * as codepipeline from "@aws-cdk/aws-codepipeline";
import * as codepipeline_actions from "@aws-cdk/aws-codepipeline-actions";
import * as codestar_noti from "@aws-cdk/aws-codestarnotifications";
import * as sns from "@aws-cdk/aws-sns";

    const pipeline = new codepipeline.Pipeline(...);
    const topicArn = props.sns_arn_for_developer;
    const targetTopic = sns.Topic.fromTopicArn(
      this,
      "sns-notification-topic",
      topicArn
    );
    new codestar_noti.NotificationRule(this, "Notification", {
      detailType: codestar_noti.DetailType.BASIC,
      events: [
        "codepipeline-pipeline-pipeline-execution-started",
        "codepipeline-pipeline-pipeline-execution-failed",
        "codepipeline-pipeline-pipeline-execution-succeeded",
        "codepipeline-pipeline-pipeline-execution-canceled",
      ],
      source: pipeline,
      targets: [targetTopic],
    });

下面是生成的cloudformation的片段。

    "Notification2267453E": {
      "Type": "AWS::CodeStarNotifications::NotificationRule",
      "Properties": {
        "DetailType": "BASIC",
        "EventTypeIds": [
          "codepipeline-pipeline-pipeline-execution-started",
          "codepipeline-pipeline-pipeline-execution-failed",
          "codepipeline-pipeline-pipeline-execution-succeeded",
          "codepipeline-pipeline-pipeline-execution-canceled"
        ],
        "Name": "sagemakerbringyourownNotification36194CEC",
        "Resource": {
          "Fn::Join": [
            "",
            [
              "arn:",
              {
                "Ref": "AWS::Partition"
              },
              ":codepipeline:ap-southeast-1:305326993135:",
              {
                "Ref": "sagemakerbringyourownpipeline0A8C43B1"
              }
            ]
          ]
        },
        "Targets": [
          {
            "TargetAddress": "arn:aws:sns:ap-southeast-1:305326993135:whitespace_alerts",
            "TargetType": "SNS"
          }
        ]
      },
      "Metadata": {
        "aws:cdk:path": "sagemaker-bring-your-own/Notification/Resource"
      }
    },

Answer 1

这是因为不能修改导入的资源。正如您在注释中指出的，设置通知涉及修改主题资源，特别是其访问策略。

参考资料：https://docs.aws.amazon.com/cdk/v2/guide/resources.html#resources_importing

Answer 2

FWIW，我从创建Topic的CDK应用程序中获得了完全相同的错误Topic(不是导入的)。事实证明，这是一个暂时的问题，因为它第二次成功，没有任何变化。我怀疑这是由于一个非常大的ECR映像，这是第一次构建作为部署的一部分，这需要相当长的时间。我的猜测是，这个主题超时了，进入了一种等待创建NotificationRule的奇怪状态。

Answer 3

我按照这个顺序做了以下工作来解决这个问题：

1. 首先从SNS主题的资源策略中删除以下语句。
2. 然后部署堆栈(有趣的是，在堆栈部署完成后没有添加任何内容)
3. ，手动更新资源策略以添加以下语句。

    {
      "Sid": "AWSCodeStarNotifications_publish",
      "Effect": "Allow",
      "Principal": {
        "Service": "codestar-notifications.amazonaws.com"
      },
      "Action": "SNS:Publish",
      "Resource": "arn:aws:sns:ap-south-1:xxxxxxxxx:test"
    }