资源创建破坏堆栈部署

Question

因此，我试图对使用AWS Config和大约14条托管规则所需的所有基础设施进行干净的部署。当AWS Config已经在特定帐户中启用时，我就会出现这个问题，因为它不喜欢我试图重新部署必要的Infra (Config Recorder和Config传递通道)。我正在尝试设置我的逻辑，以便在现有基础结构出现错误时立即尝试部署规则。这是我的代码：

 import cdk = require('@aws-cdk/core')
import lambda = require('@aws-cdk/aws-lambda');
import path = require('path')
import s3 = require('@aws-cdk/aws-s3');
import iam = require('@aws-cdk/aws-iam');
import config = require('@aws-cdk/aws-config');
import { ManagedRule } from '@aws-cdk/aws-config';
import events = require('@aws-cdk/aws-events');
import targets = require('@aws-cdk/aws-events-targets');
import { Arn, Aws } from '@aws-cdk/core';
import core = require('@aws-cdk/core')
import { allowedNodeEnvironmentFlags, env } from 'process';
import { SnsTopic } from '@aws-cdk/aws-events-targets';
import * as deliveryChannelConfigStack from '../lib/deliveryChannelConfig';




export class fullConfigStack extends cdk.Stack {
    constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
      super(scope, id, props);
      const globalConfigRole = new iam.Role(this, 'globalConfigRole', {
        assumedBy: new iam.ServicePrincipal('config.amazonaws.com'),   // required
    });

   
    globalConfigRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSConfig'));
    globalConfigRole.addManagedPolicy(iam.ManagedPolicy.fromAwsManagedPolicyName('ReadOnlyAccess'));
    
      const globalConfigRecorder = new config.CfnConfigurationRecorder(this, 'globalConfigRecorder',{
        roleArn: globalConfigRole.roleArn,    
        name: 'globalConfigRecorder',
        recordingGroup: {
          allSupported: true,
          includeGlobalResourceTypes: true
      }
    });
    const globalConfigBucket = new s3.Bucket(this, 'globalConfigBucket',{
        accessControl: s3.BucketAccessControl.LOG_DELIVERY_WRITE
      });
    const cisConfigDeliveryChannel = new config.CfnDeliveryChannel(this,'cisConfigDeliveryChannel',{
        s3BucketName: globalConfigBucket.bucketName,
        configSnapshotDeliveryProperties: {
            deliveryFrequency: 'TwentyFour_Hours'
        }
    });
    const generalConfigRole = new iam.Role(this,  'generalConfigRole',{
        assumedBy: new iam.ServicePrincipal('config.amazonaws.com')
      });

      const cloudTrailEnabledRule = new ManagedRule(this, 'cloudTrailEnabledRule', {
        identifier: 'CLOUD_TRAIL_ENABLED'
      });
     
      const userGroupMembershipRule = new ManagedRule(this, 'userGroupMembershipRule',{
        identifier: 'IAM_USER_GROUP_MEMBERSHIP_CHECK'
      });


      const rootAccountMfaEnabledRule = new ManagedRule(this, 'rootAccountMfaEnabledRule',{
        identifier: 'ROOT_ACCOUNT_MFA_ENABLED'
      });
      const accessKeysRotatedRule = new ManagedRule(this, 'accessKeysRotatedRule',{
        identifier:'ACCESS_KEYS_ROTATED',
        inputParameters: {
          maxAccessKeyAge: 90 //rule triggers off of config change and keys must be rotated within 100 days
        }
      });
      const  iamPasswordPolicyRule = new ManagedRule(this, 'iamPasswordPolicyRule',{
        identifier: 'IAM_PASSWORD_POLICY',
        inputParameters: {
            RequireUppercaseCharacters: true, 
            RequireLowercaseCharacters: true,        
            RequireSymbols: true, 
            RequireNumbers: true, 
            MinimumPasswordLength: 14, 
            PasswordReusePrevention: 24, 
            MaxPasswordAge: 90
         
        }
      });
      const cloudTrailEncryptionRule = new ManagedRule(this, 'cloudTrailEncryptionRule' ,{
        identifier:'CLOUD_TRAIL_ENCRYPTION_ENABLED',

      });
      const defaultSecurityGroupEniRule = new ManagedRule(this, 'defaultSecurityGroupEniRule',{
        identifier:'EC2_SECURITY_GROUP_ATTACHED_TO_ENI'
      });

      const ebsVolumeEncryption = new ManagedRule(this, 'ebsVolumeEncryption',{
        identifier:'EC2_EBS_ENCRYPTION_BY_DEFAULT'
      });
      const rdsStorageEncryptionRule = new ManagedRule(this, 'rdsStorageEncryptionRule',{
        identifier: 'RDS_STORAGE_ENCRYPTED'
        //This may need the arn of the kms key used for encryption
      });

      const s3ConfigLoggingEnabledBucket = new s3.Bucket(this, 's3ConfigLoggingEnabledBucket',{
        accessControl: s3.BucketAccessControl.LOG_DELIVERY_WRITE
      }); 


      const s3BucketLoggingEnabledRule = new ManagedRule(this, 's3BucketLoggingEnabledRule',{
        identifier: 'S3_BUCKET_LOGGING_ENABLED',
        // inputParameters: {
        //   targetBucket:  s3ConfigLoggingEnabledBucket,
        });

      const s3BucketServerSideEncryptionRule = new ManagedRule(this, 's3BucketServerSideEncryptionRule',{
        identifier:'S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED'
      });

        const vpcFlowLogsEnabledRule = new ManagedRule(this, 'vpcFlowLogsEnabledRule',{
        identifier:'VPC_FLOW_LOGS_ENABLED',
        inputParameters: {
          trafficType:'ALL' //vpcs must track all traffic (ALLOW and DENY) with this rule
        }
      });

      const vpcDefaultSecurityGroupRule = new ManagedRule(this, 'vpcDefaultSecurityGroupRule',{
        identifier:'VPC_DEFAULT_SECURITY_GROUP_CLOSED'
      });

      const mfaEnabledForConsoleAccessRule = new ManagedRule(this, 'mfaEnabledForConsoleAccessRule',{
        identifier: 'MFA_ENABLED_FOR_IAM_CONSOLE_ACCESS'
      });

      const rdsMultiAvailZoneRule = new ManagedRule(this, 'rdsMultiAvailZoneRule',{
        identifier:'RDS_MULTI_AZ_SUPPORT'
      });

      const iamUserUnusedCredentialsRule = new ManagedRule(this, 'iamUserUnusedCredentialsRule',{
        identifier: 'IAM_USER_UNUSED_CREDENTIALS_CHECK',
        inputParameters: {
          maxCredentialUsageAge: 90
        }
      });

正如您在代码中看到的，我正在创建一个角色--配置记录器、configBucket、传递通道和大约14个托管规则。现在，如果我将这段代码分成两个不同的堆栈，一个只是下面的堆栈，另一个是规则。它们自己部署的规则非常好，不管它们是否已经部署。但是，如果我试图部署整个程序，就会得到以下错误：

You must create a configuration recorder before you can create or update a Config rule. (Service: AmazonConfig; Status Code: 400; Error Code: NoAvailableConfigurationRecorderException; Request ID: a2951019-1
d7b-44a9-8df2-83e6a4a0e229; Proxy: null)

我认为我得到这个的原因是因为录音机需要更长的时间来部署，因此程序试图移到规则和错误之外。我的问题是，有什么方法可以让我的节目，直到录音机和传送渠道完成？或者，我可以在另一个堆栈中这样做，并使用IF、否则逻辑或其他类似的方法引用堆栈吗？谢谢大家！

Answer 1

根据文献资料

有时AWS资源依赖于其他资源，在启动下一个资源之前必须完成一个资源的创建。如果需要添加不自动推断的排序依赖项，则可以使用constructA.node.addDependency(constructB)添加依赖关系。

您可以在资源之间添加其他依赖项，如下所示：

globalConfigRole.node.addDependency(globalConfigRecorder)