首页
学习
活动
专区
圈层
工具
发布
首页
学习
活动
专区
圈层
工具
MCP广场
社区首页 >问答首页 >无法验证以下目标配置(s3到SNS)

无法验证以下目标配置(s3到SNS)
EN

Stack Overflow用户
提问于 2022-10-29 10:44:17
回答 1查看 37关注 0票数 0

我试图在s3上设置一个事件通知系统,以便在文件上载到s3时将通知发布到s3。以下是我如何通过CDK实现的:

代码语言:javascript
运行
复制
import * as sns from "monocdk/aws-sns";
import * as iam from "monocdk/aws-iam";
import {
  GAMMA_ACCOUNT,
  PROD_ACCOUNT,
  UAT1_ACCOUNT,
  UAT2_ACCOUNT,
  PERFECT_MILE_ACCOUNT,
} from "../utils/constants/awsAccounts";
import { Construct } from "monocdk";
import * as s3 from "monocdk/aws-s3";
import * as s3n from "monocdk/aws-s3-notifications";
import { CommonResourceStackProps, Stage } from "../stack/CommonResourcesStack";

export class S3NotificationToSNSCustomResource extends Construct {
  constructor(
    scope: Construct,
    id: string,
    bucket: s3.IBucket,
    stackProps: CommonResourceStackProps
  ) {
    super(scope, id);
    const topic = new sns.Topic(this, "Topic", {
      displayName: "Sherlock-s3-Event-Notifications-Topic",
      topicName: "Sherlock-s3-Event-Notifications-Topic",
    });
    const topicPolicy = new sns.TopicPolicy(this, "TopicPolicy", {
      topics: [topic],
    });

    const s3ServicePrincipal = new iam.ServicePrincipal("s3.amazonaws.com");

    topicPolicy.document.addStatements(
      new iam.PolicyStatement({
        sid: "0",
        actions: ["sns:Publish"],
        principals: [s3ServicePrincipal],
        resources: [topic.topicArn],
        conditions: {
          StringEquals: {
            "AWS:SourceOwner":
              stackProps.stage == Stage.Prod
                ? PROD_ACCOUNT
                : stackProps.stage == Stage.Gamma
                ? GAMMA_ACCOUNT
                : stackProps.stage == Stage.UAT1
                ? UAT1_ACCOUNT
                : UAT2_ACCOUNT,
          },
          ArnLike: { "AWS:SourceArn": bucket.bucketArn },
        },
      }),
      new iam.PolicyStatement({
        sid: "1",
        actions: ["sns:Subscribe"],
        principals: [new iam.AccountPrincipal(PERFECT_MILE_ACCOUNT)],
        resources: [topic.topicArn],
      })
    );

    bucket.addEventNotification(
      s3.EventType.OBJECT_CREATED,
      new s3n.SnsDestination(topic),
      { prefix: "output/reportingData/openItems/", suffix: "_SUCCESS" }
    );
  }
}

但是,当我尝试部署它时,我得到以下错误:在调用InvalidArgument操作时发生错误( PutBucketNotificationConfiguration ):无法验证以下目标配置

有人能帮我吗?

我读了这篇文章(https://aws.amazon.com/premiumsupport/knowledge-center/unable-validate-destination-s3/),但是它的解析是使用模板,我正在使用CDK包实现。此外,我还添加了所有要发布和订阅的访问策略。

EN

回答 1

Stack Overflow用户

发布于 2022-10-30 08:47:32

aws:SourceAccount和aws:SourceOwner是并非所有服务都支持的条件键。亚马逊S3通知使用aws:SourceAccount Refer https://docs.aws.amazon.com/sns/latest/dg/sns-access-policy-use-cases.html#source-account-versus-source-owner

票数 1
EN
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接:

https://stackoverflow.com/questions/74244619

复制
相关文章

相似问题

领券
问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档