终止支持通知：2026 年 10 月 7 日， AWS 将终止对的支持。 AWS Proton 2026 年 10 月 7 日之后，您将无法再访问 AWS Proton 控制台或 AWS Proton 资源。您部署的基础架构将保持不变。有关更多信息，请参阅《[AWS Proton 服务弃用和迁移指南》](https://docs.aws.amazon.com/proton/latest/userguide/proton-end-of-support.html)。 本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # AWS Proton 基础架构即代码文件 模板包的主要部分是*基础设施即代码 (IaC) 文件*，用于定义要置备的基础架构资源和属性。 AWS CloudFormation 以及其他基础设施即代码引擎使用这些类型的文件来配置基础架构资源。 **注意** 也可以独立于模板捆绑包使用 IaC 文件，以作为*直接定义的组件* 的直接输入。有关组件的更多信息，请参阅[AWS Proton 组件](ag-components.md)。 AWS Proton 目前支持两种类型的 IaC 文件： + *[CloudFormation](ag-infrastructure-tmp-files-cloudformation.md)文件*-用于*AWS托管配置*。 AWS Proton 在 CloudFormation 模板文件格式之上使用 Jinja 进行参数化。 + *[Terraform HCL](ag-infrastructure-tmp-files-terraform.md) 文件* - 用于*自托管式预置*。HCL 本身支持参数化。 您不能使用多种配置方法来配置 AWS Proton 资源。您必须使用其中的一种方法。您无法将 AWS托管配置服务部署到自我管理的配置环境，反之亦然。 有关更多信息，请参阅[如何配置 AWS Proton 基础架构](ag-works-prov-methods.md)、[AWS Proton 环境](ag-environments.md)、[AWS Proton 服务](ag-services.md)和[AWS Proton 组件](ag-components.md)。 # CloudFormation IaC 文件 通过学习如何使用 AWS CloudFormation 基础架构作为代码文件 AWS Proton。 CloudFormation 是一项基础设施即代码 (IaC) 服务，可帮助您对 AWS 资源进行建模和设置。您可以在模板中定义基础架构资源，在 CloudFormation 模板文件格式之上使用 Jinja 进行参数化。 AWS Proton 展开参数并呈现完整 CloudFormation 模板。 CloudFormation 将定义的资源配置为 CloudFormation 堆栈。有关更多信息，请参阅《 CloudFormation 用户指南》中的[什么是 CloudFormation？](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html)** AWS Proton 支持 [AWS CloudFormation IaC 的托管配置](ag-works-prov-methods.md#ag-works-prov-methods-direct)。 ## 从您自己的现有基础设施即代码文件开始 您可以调整*自己现有的基础设施即*代码 (IaC) 文件以供使用 AWS Proton。 以下 CloudFormation 示例（示[例 1](#ag-env-cfn-example) 和示[例 2](#ag-svc-cfn-example)）代表*您自己的现有* CloudFormation IaC 文件。 CloudFormation 可以使用这些文件来创建两个不同的 CloudFormation堆栈。 在[示例 1](#ag-env-cfn-example) 中，将 CloudFormation IaC 文件配置为配置基础架构，以便在容器应用程序之间共享。在该示例中，添加了输入参数，以便使用相同的 IaC 文件创建多组预置的基础设施。每个集合可以具有不同的名称以及不同的 VPC 和子网 CIDR 值集。作为管理员或开发人员，在使用 IaC 文件配置基础设施资源时，您需要为这些参数提供值。 CloudFormation为了方便起见，这些输入参数标有注释，并在该示例中多次引用。*输出*是在模板末尾定义的。它们可以在其他 CloudFormation IaC 文件中引用。 在[示例 2](#ag-svc-cfn-example) 中，将 CloudFormation IaC 文件配置为将应用程序部署到*示例* 1 中配置的基础架构。为了方便起见，对这些参数进行了注释。 ### 示例 1： CloudFormation IaC 文件 ``` AWSTemplateFormatVersion: '2010-09-09' Description: AWS Fargate cluster running containers in a public subnet. Only supports public facing load balancer, and public service discovery namespaces. Parameters: VpcCIDR: # input parameter Description: CIDR for VPC Type: String Default: "10.0.0.0/16" SubnetOneCIDR: # input parameter Description: CIDR for SubnetOne Type: String Default: "10.0.0.0/24" SubnetTwoCIDR: # input parameters Description: CIDR for SubnetTwo Type: String Default: "10.0.1.0/24" Resources: VPC: Type: AWS::EC2::VPC Properties: EnableDnsSupport: true EnableDnsHostnames: true CidrBlock: Ref: 'VpcCIDR' # Two public subnets, where containers will have public IP addresses PublicSubnetOne: Type: AWS::EC2::Subnet Properties: AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: {Ref: 'AWS::Region'} VpcId: !Ref 'VPC' CidrBlock: Ref: 'SubnetOneCIDR' MapPublicIpOnLaunch: true PublicSubnetTwo: Type: AWS::EC2::Subnet Properties: AvailabilityZone: Fn::Select: - 1 - Fn::GetAZs: {Ref: 'AWS::Region'} VpcId: !Ref 'VPC' CidrBlock: Ref: 'SubnetTwoCIDR' MapPublicIpOnLaunch: true # Setup networking resources for the public subnets. Containers # in the public subnets have public IP addresses and the routing table # sends network traffic via the internet gateway. InternetGateway: Type: AWS::EC2::InternetGateway GatewayAttachement: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref 'VPC' InternetGatewayId: !Ref 'InternetGateway' PublicRouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref 'VPC' PublicRoute: Type: AWS::EC2::Route DependsOn: GatewayAttachement Properties: RouteTableId: !Ref 'PublicRouteTable' DestinationCidrBlock: '0.0.0.0/0' GatewayId: !Ref 'InternetGateway' PublicSubnetOneRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: SubnetId: !Ref PublicSubnetOne RouteTableId: !Ref PublicRouteTable PublicSubnetTwoRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: SubnetId: !Ref PublicSubnetTwo RouteTableId: !Ref PublicRouteTable # ECS Resources ECSCluster: Type: AWS::ECS::Cluster # A security group for the containers we will run in Fargate. # Rules are added to this security group based on what ingress you # add for the cluster. ContainerSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Access to the Fargate containers VpcId: !Ref 'VPC' # This is a role which is used by the ECS tasks themselves. ECSTaskExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: [ecs-tasks.amazonaws.com] Action: ['sts:AssumeRole'] Path: / ManagedPolicyArns: - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy' # These output values will be available to other templates to use. Outputs: ClusterName: # output Description: The name of the ECS cluster Value: !Ref 'ECSCluster' Export: Name: Fn::Sub: "${AWS::StackName}-ECSCluster" ECSTaskExecutionRole: # output Description: The ARN of the ECS role Value: !GetAtt 'ECSTaskExecutionRole.Arn' Export: Name: Fn::Sub: "${AWS::StackName}-ECSTaskExecutionRole" VpcId: # output Description: The ID of the VPC that this stack is deployed in Value: !Ref 'VPC' Export: Name: Fn::Sub: "${AWS::StackName}-VPC" PublicSubnetOne: # output Description: Public subnet one Value: !Ref 'PublicSubnetOne' Export: Name: Fn::Sub: "${AWS::StackName}-PublicSubnetOne" PublicSubnetTwo: # output Description: Public subnet two Value: !Ref 'PublicSubnetTwo' Export: Name: Fn::Sub: "${AWS::StackName}-PublicSubnetTwo" ContainerSecurityGroup: # output Description: A security group used to allow Fargate containers to receive traffic Value: !Ref 'ContainerSecurityGroup' Export: Name: Fn::Sub: "${AWS::StackName}-ContainerSecurityGroup" ``` ### 示例 2： CloudFormation IaC 文件 ``` AWSTemplateFormatVersion: '2010-09-09' Description: Deploy a service on AWS Fargate, hosted in a public subnet, and accessible via a public load balancer. Parameters: ContainerPortInput: # input parameter Description: The port to route traffic to Type: Number Default: 80 TaskCountInput: # input parameter Description: The default number of Fargate tasks you want running Type: Number Default: 1 TaskSizeInput: # input parameter Description: The size of the task you want to run Type: String Default: x-small ContainerImageInput: # input parameter Description: The name/url of the container image Type: String Default: "public.ecr.aws/z9d2n7e1/nginx:1.19.5" TaskNameInput: # input parameter Description: Name for your task Type: String Default: "my-fargate-instance" StackName: # input parameter Description: Name of the environment stack to deploy to Type: String Default: "my-fargate-environment" Mappings: TaskSizeMap: x-small: cpu: 256 memory: 512 small: cpu: 512 memory: 1024 medium: cpu: 1024 memory: 2048 large: cpu: 2048 memory: 4096 x-large: cpu: 4096 memory: 8192 Resources: # A log group for storing the stdout logs from this service's containers LogGroup: Type: AWS::Logs::LogGroup Properties: LogGroupName: Ref: 'TaskNameInput' # input parameter # The task definition. This is a simple metadata description of what # container to run, and what resource requirements it has. TaskDefinition: Type: AWS::ECS::TaskDefinition Properties: Family: !Ref 'TaskNameInput' Cpu: !FindInMap [TaskSizeMap, !Ref 'TaskSizeInput', cpu] Memory: !FindInMap [TaskSizeMap, !Ref 'TaskSizeInput', memory] NetworkMode: awsvpc RequiresCompatibilities: - FARGATE ExecutionRoleArn: Fn::ImportValue: !Sub "${StackName}-ECSTaskExecutionRole" # output parameter from another CloudFormation template awslogs-region: !Ref 'AWS::Region' awslogs-stream-prefix: !Ref 'TaskNameInput' # The service_instance. The service is a resource which allows you to run multiple # copies of a type of task, and gather up their logs and metrics, as well # as monitor the number of running tasks and replace any that have crashed Service: Type: AWS::ECS::Service DependsOn: LoadBalancerRule Properties: ServiceName: !Ref 'TaskNameInput' Cluster: Fn::ImportValue: !Sub "${StackName}-ECSCluster" # output parameter from another CloudFormation template LaunchType: FARGATE DeploymentConfiguration: MaximumPercent: 200 MinimumHealthyPercent: 75 DesiredCount: !Ref 'TaskCountInput' NetworkConfiguration: AwsvpcConfiguration: AssignPublicIp: ENABLED SecurityGroups: - Fn::ImportValue: !Sub "${StackName}-ContainerSecurityGroup" # output parameter from another CloudFormation template Subnets: - Fn::ImportValue:r CloudFormation template TaskRoleArn: !Ref "AWS::NoValue" ContainerDefinitions: - Name: !Ref 'TaskNameInput' Cpu: !FindInMap [TaskSizeMap, !Ref 'TaskSizeInput', cpu] Memory: !FindInMap [TaskSizeMap, !Ref 'TaskSizeInput', memory] Image: !Ref 'ContainerImageInput' # input parameter PortMappings: - ContainerPort: !Ref 'ContainerPortInput' # input parameter LogConfiguration: LogDriver: 'awslogs' Options: awslogs-group: !Ref 'TaskNameInput' !Sub "${StackName}-PublicSubnetOne" # output parameter from another CloudFormation template - Fn::ImportValue: !Sub "${StackName}-PublicSubnetTwo" # output parameter from another CloudFormation template TaskDefinition: !Ref 'TaskDefinition' LoadBalancers: - ContainerName: !Ref 'TaskNameInput' ContainerPort: !Ref 'ContainerPortInput' # input parameter TargetGroupArn: !Ref 'TargetGroup' # A target group. This is used for keeping track of all the tasks, and # what IP addresses / port numbers they have. You can query it yourself, # to use the addresses yourself, but most often this target group is just # connected to an application load balancer, or network load balancer, so # it can automatically distribute traffic across all the targets. TargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckIntervalSeconds: 6 HealthCheckPath: / HealthCheckProtocol: HTTP HealthCheckTimeoutSeconds: 5 HealthyThresholdCount: 2 TargetType: ip Name: !Ref 'TaskNameInput' Port: !Ref 'ContainerPortInput' Protocol: HTTP UnhealthyThresholdCount: 2 VpcId: Fn::ImportValue: !Sub "${StackName}-VPC" # output parameter from another CloudFormation template # Create a rule on the load balancer for routing traffic to the target group LoadBalancerRule: Type: AWS::ElasticLoadBalancingV2::ListenerRule Properties: Actions: - TargetGroupArn: !Ref 'TargetGroup' Type: 'forward' Conditions: - Field: path-pattern Values: - '*' ListenerArn: !Ref PublicLoadBalancerListener Priority: 1 # Enable autoscaling for this service ScalableTarget: Type: AWS::ApplicationAutoScaling::ScalableTarget DependsOn: Service Properties: ServiceNamespace: 'ecs' ScalableDimension: 'ecs:service:DesiredCount' ResourceId: Fn::Join: - '/' - - service - Fn::ImportValue: !Sub "${StackName}-ECSCluster" - !Ref 'TaskNameInput' MinCapacity: 1 MaxCapacity: 10 RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService # Create scaling policies for the service ScaleDownPolicy: Type: AWS::ApplicationAutoScaling::ScalingPolicy DependsOn: ScalableTarget Properties: PolicyName: Fn::Join: - '/' - - scale - !Ref 'TaskNameInput' - down PolicyType: StepScaling ResourceId: Fn::Join: - '/' - - service - Fn::ImportValue: !Sub "${StackName}-ECSCluster" # output parameter from another CloudFormation template - !Ref 'TaskNameInput' ScalableDimension: 'ecs:service:DesiredCount' ServiceNamespace: 'ecs' StepScalingPolicyConfiguration: AdjustmentType: 'ChangeInCapacity' StepAdjustments: - MetricIntervalUpperBound: 0 ScalingAdjustment: -1 MetricAggregationType: 'Average' Cooldown: 60 ScaleUpPolicy: Type: AWS::ApplicationAutoScaling::ScalingPolicy DependsOn: ScalableTarget Properties: PolicyName: Fn::Join: - '/' - - scale - !Ref 'TaskNameInput' - up PolicyType: StepScaling ResourceId: Fn::Join: - '/' - - service - Fn::ImportValue: !Sub "${StackName}-ECSCluster" - !Ref 'TaskNameInput' ScalableDimension: 'ecs:service:DesiredCount' ServiceNamespace: 'ecs' StepScalingPolicyConfiguration: AdjustmentType: 'ChangeInCapacity' StepAdjustments: - MetricIntervalLowerBound: 0 MetricIntervalUpperBound: 15 ScalingAdjustment: 1 - MetricIntervalLowerBound: 15 MetricIntervalUpperBound: 25 ScalingAdjustment: 2 - MetricIntervalLowerBound: 25 ScalingAdjustment: 3 MetricAggregationType: 'Average' Cooldown: 60 # Create alarms to trigger these policies LowCpuUsageAlarm: Type: AWS::CloudWatch::Alarm Properties: AlarmName: Fn::Join: - '-' - - low-cpu - !Ref 'TaskNameInput' AlarmDescription: Fn::Join: - ' ' - - "Low CPU utilization for service" - !Ref 'TaskNameInput' MetricName: CPUUtilization Namespace: AWS/ECS Dimensions: - Name: ServiceName Value: !Ref 'TaskNameInput' - Name: ClusterName Value: Fn::ImportValue: !Sub "${StackName}-ECSCluster" Statistic: Average Period: 60 EvaluationPeriods: 1 Threshold: 20 ComparisonOperator: LessThanOrEqualToThreshold AlarmActions: - !Ref ScaleDownPolicy HighCpuUsageAlarm: Type: AWS::CloudWatch::Alarm Properties: AlarmName: Fn::Join: - '-' - - high-cpu - !Ref 'TaskNameInput' AlarmDescription: Fn::Join: - ' ' - - "High CPU utilization for service" - !Ref 'TaskNameInput' MetricName: CPUUtilization Namespace: AWS/ECS Dimensions: - Name: ServiceName Value: !Ref 'TaskNameInput' - Name: ClusterName Value: Fn::ImportValue: !Sub "${StackName}-ECSCluster" Statistic: Average Period: 60 EvaluationPeriods: 1 Threshold: 70 ComparisonOperator: GreaterThanOrEqualToThreshold AlarmActions: - !Ref ScaleUpPolicy EcsSecurityGroupIngressFromPublicALB: Type: AWS::EC2::SecurityGroupIngress Properties: Description: Ingress from the public ALB GroupId: Fn::ImportValue: !Sub "${StackName}-ContainerSecurityGroup" IpProtocol: -1 SourceSecurityGroupId: !Ref 'PublicLoadBalancerSG' # Public load balancer, hosted in public subnets that is accessible # to the public, and is intended to route traffic to one or more public # facing services. This is used for accepting traffic from the public # internet and directing it to public facing microservices PublicLoadBalancerSG: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Access to the public facing load balancer VpcId: Fn::ImportValue: !Sub "${StackName}-VPC" SecurityGroupIngress: # Allow access to ALB from anywhere on the internet - CidrIp: 0.0.0.0/0 IpProtocol: -1 PublicLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Scheme: internet-facing LoadBalancerAttributes: - Key: idle_timeout.timeout_seconds Value: '30' Subnets: # The load balancer is placed into the public subnets, so that traffic # from the internet can reach the load balancer directly via the internet gateway - Fn::ImportValue: !Sub "${StackName}-PublicSubnetOne" - Fn::ImportValue: !Sub "${StackName}-PublicSubnetTwo" SecurityGroups: [!Ref 'PublicLoadBalancerSG'] PublicLoadBalancerListener: Type: AWS::ElasticLoadBalancingV2::Listener DependsOn: - PublicLoadBalancer Properties: DefaultActions: - TargetGroupArn: !Ref 'TargetGroup' Type: 'forward' LoadBalancerArn: !Ref 'PublicLoadBalancer' Port: 80 Protocol: HTTP # These output values will be available to other templates to use. Outputs: ServiceEndpoint: # output Description: The URL to access the service Value: !Sub "http://${PublicLoadBalancer.DNSName}" ``` 您可以调整这些文件以供使用 AWS Proton。 ## 将您的基础架构即代码带到 AWS Proton 只需稍作修改，即可将[示例 1](#ag-env-cfn-example) 用作用于部署环境的环境模板包的基础架构即 AWS Proton 代码 (IaC) 文件（如示[例 3](#ag-proton-env-cfn-example) 所示）。 您可以使用 [Jinja](https://jinja.palletsprojects.com/en/2.11.x/templates/) 语法来引用在基于 Ope [n API](https://swagger.io/docs/specification/data-models/) 的[架构文件](ag-schema.md)中定义的参数，而不是使用参数。 CloudFormation 为了方便起见，对这些输入参数进行了注释，并在 IaC 文件中多次引用这些参数。这样， AWS Proton 就可以审计和检查参数值。它也可以将一个 IaC 文件中的输出参数值与另一个 IaC 文件中的参数进行匹配和插入。 作为管理员，您可以将 AWS Proton `environment.inputs.`命名空间添加到输入参数中。在服务 IaC 文件中引用环境 IaC 文件输出时，您可以将 `environment.outputs.` 命名空间添加到输出中（例如 `environment.outputs.ClusterName`）。最后，用大括号和引号将它们括起来和引起来。 通过这些修改，您的 CloudFormation IaC 文件就可以被使用了。 AWS Proton ### 示例 3： AWS Proton 环境基础架构作为代码文件 ``` AWSTemplateFormatVersion: '2010-09-09' Description: AWS Fargate cluster running containers in a public subnet. Only supports public facing load balancer, and public service discovery prefixes. Mappings: # The VPC and subnet configuration is passed in via the environment spec. SubnetConfig: VPC: CIDR: '{{ environment.inputs.vpc_cidr}}' # input parameter PublicOne: CIDR: '{{ environment.inputs.subnet_one_cidr}}' # input parameter PublicTwo: CIDR: '{{ environment.inputs.subnet_two_cidr}}' # input parameter Resources: VPC: Type: AWS::EC2::VPC Properties: EnableDnsSupport: true EnableDnsHostnames: true CidrBlock: !FindInMap ['SubnetConfig', 'VPC', 'CIDR'] # Two public subnets, where containers will have public IP addresses PublicSubnetOne: Type: AWS::EC2::Subnet Properties: AvailabilityZone: Fn::Select: - 0 - Fn::GetAZs: {Ref: 'AWS::Region'} VpcId: !Ref 'VPC' CidrBlock: !FindInMap ['SubnetConfig', 'PublicOne', 'CIDR'] MapPublicIpOnLaunch: true PublicSubnetTwo: Type: AWS::EC2::Subnet Properties: AvailabilityZone: Fn::Select: - 1 - Fn::GetAZs: {Ref: 'AWS::Region'} VpcId: !Ref 'VPC' CidrBlock: !FindInMap ['SubnetConfig', 'PublicTwo', 'CIDR'] MapPublicIpOnLaunch: true # Setup networking resources for the public subnets. Containers # in the public subnets have public IP addresses and the routing table # sends network traffic via the internet gateway. InternetGateway: Type: AWS::EC2::InternetGateway GatewayAttachement: Type: AWS::EC2::VPCGatewayAttachment Properties: VpcId: !Ref 'VPC' InternetGatewayId: !Ref 'InternetGateway' PublicRouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref 'VPC' PublicRoute: Type: AWS::EC2::Route DependsOn: GatewayAttachement Properties: RouteTableId: !Ref 'PublicRouteTable' DestinationCidrBlock: '0.0.0.0/0' GatewayId: !Ref 'InternetGateway' PublicSubnetOneRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: SubnetId: !Ref PublicSubnetOne RouteTableId: !Ref PublicRouteTable PublicSubnetTwoRouteTableAssociation: Type: AWS::EC2::SubnetRouteTableAssociation Properties: SubnetId: !Ref PublicSubnetTwo RouteTableId: !Ref PublicRouteTable # ECS Resources ECSCluster: Type: AWS::ECS::Cluster # A security group for the containers we will run in Fargate. # Rules are added to this security group based on what ingress you # add for the cluster. ContainerSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Access to the Fargate containers VpcId: !Ref 'VPC' # This is a role which is used by the ECS tasks themselves. ECSTaskExecutionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Effect: Allow Principal: Service: [ecs-tasks.amazonaws.com] Action: ['sts:AssumeRole'] Path: / ManagedPolicyArns: - 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy' # These output values are available to service infrastructure as code files as outputs, when given the # the 'service_instance.environment.outputs.' namespace, for example, service_instance.environment.outputs.ClusterName. Outputs: ClusterName: # output Description: The name of the ECS cluster Value: !Ref 'ECSCluster' ECSTaskExecutionRole: # output Description: The ARN of the ECS role Value: !GetAtt 'ECSTaskExecutionRole.Arn' VpcId: # output Description: The ID of the VPC that this stack is deployed in Value: !Ref 'VPC' PublicSubnetOne: # output Description: Public subnet one Value: !Ref 'PublicSubnetOne' PublicSubnetTwo: # output Description: Public subnet two Value: !Ref 'PublicSubnetTwo' ContainerSecurityGroup: # output Description: A security group used to allow Fargate containers to receive traffic Value: !Ref 'ContainerSecurityGroup' ``` [示例 1 和示例](#ag-env-cfn-example) [3](#ag-proton-env-cfn-example) 中的 IaC 文件生成的 CloudFormation 堆栈略有不同。参数是在堆栈模板文件中以不同方式显示的。示*例 1* CloudFormation 堆栈模板文件在堆栈模板视图中显示参数标签（密钥）。示*例 3* AWS Proton CloudFormation 基础设施堆栈模板文件显示了参数值。 AWS Proton 输入参数*不会*出现在控制台 CloudFormation堆栈参数视图中。 在[示例 4](#ag-proton-svc-cfn-example) 中， AWS Proton 服务 IaC 文件与[示例 2](#ag-svc-cfn-example) 相对应。 ### 示例 4： AWS Proton 服务实例 IaC 文件 ``` AWSTemplateFormatVersion: '2010-09-09' Description: Deploy a service on AWS Fargate, hosted in a public subnet, and accessible via a public load balancer. Mappings: TaskSize: x-small: cpu: 256 memory: 512 small: cpu: 512 memory: 1024 medium: cpu: 1024 memory: 2048 large: cpu: 2048 memory: 4096 x-large: cpu: 4096 memory: 8192 Resources: # A log group for storing the stdout logs from this service's containers LogGroup: Type: AWS::Logs::LogGroup Properties: LogGroupName: '{{service_instance.name}}' # resource parameter # The task definition. This is a simple metadata description of what # container to run, and what resource requirements it has. TaskDefinition: Type: AWS::ECS::TaskDefinition Properties: Family: '{{service_instance.name}}' Cpu: !FindInMap [TaskSize, {{service_instance.inputs.task_size}}, cpu] # input parameter Memory: !FindInMap [TaskSize, {{service_instance.inputs.task_size}}, memory] NetworkMode: awsvpc RequiresCompatibilities: - FARGATE ExecutionRoleArn: '{{environment.outputs.ECSTaskExecutionRole}}' # output from an environment infrastructure as code file TaskRoleArn: !Ref "AWS::NoValue" ContainerDefinitions: - Name: '{{service_instance.name}}' Cpu: !FindInMap [TaskSize, {{service_instance.inputs.task_size}}, cpu] Memory: !FindInMap [TaskSize, {{service_instance.inputs.task_size}}, memory] Image: '{{service_instance.inputs.image}}' PortMappings: - ContainerPort: '{{service_instance.inputs.port}}' # input parameter LogConfiguration: LogDriver: 'awslogs' Options: awslogs-group: '{{service_instance.name}}' awslogs-region: !Ref 'AWS::Region' awslogs-stream-prefix: '{{service_instance.name}}' # The service_instance. The service is a resource which allows you to run multiple # copies of a type of task, and gather up their logs and metrics, as well # as monitor the number of running tasks and replace any that have crashed Service: Type: AWS::ECS::Service DependsOn: LoadBalancerRule Properties: ServiceName: '{{service_instance.name}}' Cluster: '{{environment.outputs.ClusterName}}' # output from an environment infrastructure as code file LaunchType: FARGATE DeploymentConfiguration: MaximumPercent: 200 MinimumHealthyPercent: 75 DesiredCount: '{{service_instance.inputs.desired_count}}' # input parameter NetworkConfiguration: AwsvpcConfiguration: AssignPublicIp: ENABLED SecurityGroups: - '{{environment.outputs.ContainerSecurityGroup}}' # output from an environment infrastructure as code file Subnets: - '{{environment.outputs.PublicSubnetOne}}' # output from an environment infrastructure as code file - '{{environment.outputs.PublicSubnetTwo}}' TaskDefinition: !Ref 'TaskDefinition' LoadBalancers: - ContainerName: '{{service_instance.name}}' ContainerPort: '{{service_instance.inputs.port}}' TargetGroupArn: !Ref 'TargetGroup' # A target group. This is used for keeping track of all the tasks, and # what IP addresses / port numbers they have. You can query it yourself, # to use the addresses yourself, but most often this target group is just # connected to an application load balancer, or network load balancer, so # it can automatically distribute traffic across all the targets. TargetGroup: Type: AWS::ElasticLoadBalancingV2::TargetGroup Properties: HealthCheckIntervalSeconds: 6 HealthCheckPath: / HealthCheckProtocol: HTTP HealthCheckTimeoutSeconds: 5 HealthyThresholdCount: 2 TargetType: ip Name: '{{service_instance.name}}' Port: '{{service_instance.inputs.port}}' Protocol: HTTP UnhealthyThresholdCount: 2 VpcId: '{{environment.outputs.VpcId}}' # output from an environment infrastructure as code file # Create a rule on the load balancer for routing traffic to the target group LoadBalancerRule: Type: AWS::ElasticLoadBalancingV2::ListenerRule Properties: Actions: - TargetGroupArn: !Ref 'TargetGroup' Type: 'forward' Conditions: - Field: path-pattern Values: - '*' ListenerArn: !Ref PublicLoadBalancerListener Priority: 1 # Enable autoscaling for this service ScalableTarget: Type: AWS::ApplicationAutoScaling::ScalableTarget DependsOn: Service Properties: ServiceNamespace: 'ecs' ScalableDimension: 'ecs:service:DesiredCount' ResourceId: Fn::Join: - '/' - - service - '{{environment.outputs.ClusterName}}' # output from an environment infrastructure as code file - '{{service_instance.name}}' MinCapacity: 1 MaxCapacity: 10 RoleARN: !Sub arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService # Create scaling policies for the service ScaleDownPolicy: Type: AWS::ApplicationAutoScaling::ScalingPolicy DependsOn: ScalableTarget Properties: PolicyName: Fn::Join: - '/' - - scale - '{{service_instance.name}}' - down PolicyType: StepScaling ResourceId: Fn::Join: - '/' - - service - '{{environment.outputs.ClusterName}}' - '{{service_instance.name}}' ScalableDimension: 'ecs:service:DesiredCount' ServiceNamespace: 'ecs' StepScalingPolicyConfiguration: AdjustmentType: 'ChangeInCapacity' StepAdjustments: - MetricIntervalUpperBound: 0 ScalingAdjustment: -1 MetricAggregationType: 'Average' Cooldown: 60 ScaleUpPolicy: Type: AWS::ApplicationAutoScaling::ScalingPolicy DependsOn: ScalableTarget Properties: PolicyName: Fn::Join: - '/' - - scale - '{{service_instance.name}}' - up PolicyType: StepScaling ResourceId: Fn::Join: - '/' - - service - '{{environment.outputs.ClusterName}}' - '{{service_instance.name}}' ScalableDimension: 'ecs:service:DesiredCount' ServiceNamespace: 'ecs' StepScalingPolicyConfiguration: AdjustmentType: 'ChangeInCapacity' StepAdjustments: - MetricIntervalLowerBound: 0 MetricIntervalUpperBound: 15 ScalingAdjustment: 1 - MetricIntervalLowerBound: 15 MetricIntervalUpperBound: 25 ScalingAdjustment: 2 - MetricIntervalLowerBound: 25 ScalingAdjustment: 3 MetricAggregationType: 'Average' Cooldown: 60 # Create alarms to trigger these policies LowCpuUsageAlarm: Type: AWS::CloudWatch::Alarm Properties: AlarmName: Fn::Join: - '-' - - low-cpu - '{{service_instance.name}}' AlarmDescription: Fn::Join: - ' ' - - "Low CPU utilization for service" - '{{service_instance.name}}' MetricName: CPUUtilization Namespace: AWS/ECS Dimensions: - Name: ServiceName Value: '{{service_instance.name}}' - Name: ClusterName Value: '{{environment.outputs.ClusterName}}' Statistic: Average Period: 60 EvaluationPeriods: 1 Threshold: 20 ComparisonOperator: LessThanOrEqualToThreshold AlarmActions: - !Ref ScaleDownPolicy HighCpuUsageAlarm: Type: AWS::CloudWatch::Alarm Properties: AlarmName: Fn::Join: - '-' - - high-cpu - '{{service_instance.name}}' AlarmDescription: Fn::Join: - ' ' - - "High CPU utilization for service" - '{{service_instance.name}}' MetricName: CPUUtilization Namespace: AWS/ECS Dimensions: - Name: ServiceName Value: '{{service_instance.name}}' - Name: ClusterName Value: '{{environment.outputs.ClusterName}}' Statistic: Average Period: 60 EvaluationPeriods: 1 Threshold: 70 ComparisonOperator: GreaterThanOrEqualToThreshold AlarmActions: - !Ref ScaleUpPolicy EcsSecurityGroupIngressFromPublicALB: Type: AWS::EC2::SecurityGroupIngress Properties: Description: Ingress from the public ALB GroupId: '{{environment.outputs.ContainerSecurityGroup}}' IpProtocol: -1 SourceSecurityGroupId: !Ref 'PublicLoadBalancerSG' # Public load balancer, hosted in public subnets that is accessible # to the public, and is intended to route traffic to one or more public # facing services. This is used for accepting traffic from the public # internet and directing it to public facing microservices PublicLoadBalancerSG: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Access to the public facing load balancer VpcId: '{{environment.outputs.VpcId}}' SecurityGroupIngress: # Allow access to ALB from anywhere on the internet - CidrIp: 0.0.0.0/0 IpProtocol: -1 PublicLoadBalancer: Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: Scheme: internet-facing LoadBalancerAttributes: - Key: idle_timeout.timeout_seconds Value: '30' Subnets: # The load balancer is placed into the public subnets, so that traffic # from the internet can reach the load balancer directly via the internet gateway - '{{environment.outputs.PublicSubnetOne}}' - '{{environment.outputs.PublicSubnetTwo}}' SecurityGroups: [!Ref 'PublicLoadBalancerSG'] PublicLoadBalancerListener: Type: AWS::ElasticLoadBalancingV2::Listener DependsOn: - PublicLoadBalancer Properties: DefaultActions: - TargetGroupArn: !Ref 'TargetGroup' Type: 'forward' LoadBalancerArn: !Ref 'PublicLoadBalancer' Port: 80 Protocol: HTTP Outputs: ServiceEndpoint: # output Description: The URL to access the service Value: !Sub "http://${PublicLoadBalancer.DNSName}" ``` 在[示例 5](#ag-proton-pipeline-cfn-example) 中， AWS Proton 管道 IaC 文件配置管道基础设施以支持[示](#ag-proton-svc-cfn-example)例 4 中配置的服务实例。 ### 示例 5： AWS Proton 服务管道 IaC 文件 ``` Resources: ECRRepo: Type: AWS::ECR::Repository DeletionPolicy: Retain BuildProject: Type: AWS::CodeBuild::Project Properties: Artifacts: Type: CODEPIPELINE Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0 PrivilegedMode: true Type: LINUX_CONTAINER EnvironmentVariables: - Name: repo_name Type: PLAINTEXT Value: !Ref ECRRepo - Name: service_name Type: PLAINTEXT Value: '{{ service.name }}' # resource parameter ServiceRole: Fn::GetAtt: - PublishRole - Arn Source: BuildSpec: Fn::Join: - "" - - >- { "version": "0.2", "phases": { "install": { "runtime-versions": { "docker": 18 }, "commands": [ "pip3 install --upgrade --user awscli", "echo 'f6bd1536a743ab170b35c94ed4c7c4479763356bd543af5d391122f4af852460 yq_linux_amd64' > yq_linux_amd64.sha", "wget https://github.com/mikefarah/yq/releases/download/3.4.0/yq_linux_amd64", "sha256sum -c yq_linux_amd64.sha", "mv yq_linux_amd64 /usr/bin/yq", "chmod +x /usr/bin/yq" ] }, "pre_build": { "commands": [ "cd $CODEBUILD_SRC_DIR", "$(aws ecr get-login --no-include-email --region $AWS_DEFAULT_REGION)", "{{ pipeline.inputs.unit_test_command }}", # input parameter ] }, "build": { "commands": [ "IMAGE_REPO_NAME=$repo_name", "IMAGE_TAG=$CODEBUILD_BUILD_NUMBER", "IMAGE_ID= - Ref: AWS::AccountId - >- .dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME:$IMAGE_TAG", "docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG -f {{ pipeline.inputs.dockerfile }} .", # input parameter "docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $IMAGE_ID;", "docker push $IMAGE_ID" ] }, "post_build": { "commands": [ "aws proton --region $AWS_DEFAULT_REGION get-service --name $service_name | jq -r .service.spec > service.yaml", "yq w service.yaml 'instances[*].spec.image' \"$IMAGE_ID\" > rendered_service.yaml" ] } }, "artifacts": { "files": [ "rendered_service.yaml" ] } } Type: CODEPIPELINE EncryptionKey: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn {% for service_instance in service_instances %} Deploy{{loop.index}}Project: Type: AWS::CodeBuild::Project Properties: Artifacts: Type: CODEPIPELINE Environment: ComputeType: BUILD_GENERAL1_SMALL Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0 PrivilegedMode: false Type: LINUX_CONTAINER EnvironmentVariables: - Name: service_name Type: PLAINTEXT Value: '{{service.name}}' # resource parameter - Name: service_instance_name Type: PLAINTEXT Value: '{{service_instance.name}}' # resource parameter ServiceRole: Fn::GetAtt: - DeploymentRole - Arn Source: BuildSpec: >- { "version": "0.2", "phases": { "build": { "commands": [ "pip3 install --upgrade --user awscli", "aws proton --region $AWS_DEFAULT_REGION update-service-instance --deployment-type CURRENT_VERSION --name $service_instance_name --service-name $service_name --spec file://rendered_service.yaml", "aws proton --region $AWS_DEFAULT_REGION wait service-instance-deployed --name $service_instance_name --service-name $service_name" ] } } } Type: CODEPIPELINE EncryptionKey: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn {% endfor %} # This role is used to build and publish an image to ECR PublishRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codebuild.amazonaws.com Version: "2012-10-17" PublishRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Effect: Allow Resource: - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/ - Ref: BuildProject - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/ - Ref: BuildProject - :* - Action: - codebuild:CreateReportGroup - codebuild:CreateReport - codebuild:UpdateReport - codebuild:BatchPutTestCases Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :report-group/ - Ref: BuildProject - -* - Action: - ecr:GetAuthorizationToken Effect: Allow Resource: "*" - Action: - ecr:BatchCheckLayerAvailability - ecr:CompleteLayerUpload - ecr:GetAuthorizationToken - ecr:InitiateLayerUpload - ecr:PutImage - ecr:UploadLayerPart Effect: Allow Resource: Fn::GetAtt: - ECRRepo - Arn - Action: - proton:GetService Effect: Allow Resource: "*" - Action: - s3:GetObject* - s3:GetBucket* - s3:List* - s3:DeleteObject* - s3:PutObject* - s3:Abort* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Version: "2012-10-17" PolicyName: PublishRoleDefaultPolicy Roles: - Ref: PublishRole DeploymentRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codebuild.amazonaws.com Version: "2012-10-17" DeploymentRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Effect: Allow Resource: - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/Deploy*Project* - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/Deploy*Project:* - Action: - codebuild:CreateReportGroup - codebuild:CreateReport - codebuild:UpdateReport - codebuild:BatchPutTestCases Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :report-group/Deploy*Project - -* - Action: - proton:UpdateServiceInstance - proton:GetServiceInstance Effect: Allow Resource: "*" - Action: - s3:GetObject* - s3:GetBucket* - s3:List* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Version: "2012-10-17" PolicyName: DeploymentRoleDefaultPolicy Roles: - Ref: DeploymentRole PipelineArtifactsBucketEncryptionKey: Type: AWS::KMS::Key Properties: KeyPolicy: Statement: - Action: - kms:Create* - kms:Describe* - kms:Enable* - kms:List* - kms:Put* - kms:Update* - kms:Revoke* - kms:Disable* - kms:Get* - kms:Delete* - kms:ScheduleKeyDeletion - kms:CancelKeyDeletion - kms:GenerateDataKey - kms:TagResource - kms:UntagResource Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PipelineRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PublishRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PublishRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey Effect: Allow Principal: AWS: Fn::GetAtt: - DeploymentRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - DeploymentRole - Arn Resource: "*" Version: "2012-10-17" UpdateReplacePolicy: Delete DeletionPolicy: Delete PipelineArtifactsBucket: Type: AWS::S3::Bucket Properties: VersioningConfiguration: Status: Enabled BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: KMSMasterKeyID: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn SSEAlgorithm: aws:kms PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true IgnorePublicAcls: true RestrictPublicBuckets: true UpdateReplacePolicy: Retain DeletionPolicy: Retain PipelineArtifactsBucketEncryptionKeyAlias: Type: AWS::KMS::Alias Properties: AliasName: 'alias/codepipeline-encryption-key-{{ service.name }}' TargetKeyId: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn UpdateReplacePolicy: Delete DeletionPolicy: Delete PipelineRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codepipeline.amazonaws.com Version: "2012-10-17" PipelineRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - s3:GetObject* - s3:GetBucket* - s3:List* - s3:DeleteObject* - s3:PutObject* - s3:Abort* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: codestar-connections:* Effect: Allow Resource: "*" - Action: sts:AssumeRole Effect: Allow Resource: Fn::GetAtt: - PipelineBuildCodePipelineActionRole - Arn - Action: sts:AssumeRole Effect: Allow Resource: Fn::GetAtt: - PipelineDeployCodePipelineActionRole - Arn Version: "2012-10-17" PolicyName: PipelineRoleDefaultPolicy Roles: - Ref: PipelineRole Pipeline: Type: AWS::CodePipeline::Pipeline Properties: RoleArn: Fn::GetAtt: - PipelineRole - Arn Stages: - Actions: - ActionTypeId: Category: Source Owner: AWS Provider: CodeStarSourceConnection Version: "1" Configuration: ConnectionArn: '{{ service.repository_connection_arn }}' FullRepositoryId: '{{ service.repository_id }}' BranchName: '{{ service.branch_name }}' Name: Checkout OutputArtifacts: - Name: Artifact_Source_Checkout RunOrder: 1 Name: Source - Actions: - ActionTypeId: Category: Build Owner: AWS Provider: CodeBuild Version: "1" Configuration: ProjectName: Ref: BuildProject InputArtifacts: - Name: Artifact_Source_Checkout Name: Build OutputArtifacts: - Name: BuildOutput RoleArn: Fn::GetAtt: - PipelineBuildCodePipelineActionRole - Arn RunOrder: 1 Name: Build {%- for service_instance in service_instances %} - Actions: - ActionTypeId: Category: Build Owner: AWS Provider: CodeBuild Version: "1" Configuration: ProjectName: Ref: Deploy{{loop.index}}Project InputArtifacts: - Name: BuildOutput Name: Deploy RoleArn: Fn::GetAtt: - PipelineDeployCodePipelineActionRole - Arn RunOrder: 1 Name: 'Deploy{{service_instance.name}}' {%- endfor %} ArtifactStore: EncryptionKey: Id: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Type: KMS Location: Ref: PipelineArtifactsBucket Type: S3 DependsOn: - PipelineRoleDefaultPolicy - PipelineRole PipelineBuildCodePipelineActionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Version: "2012-10-17" PipelineBuildCodePipelineActionRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - codebuild:BatchGetBuilds - codebuild:StartBuild - codebuild:StopBuild Effect: Allow Resource: Fn::GetAtt: - BuildProject - Arn Version: "2012-10-17" PolicyName: PipelineBuildCodePipelineActionRoleDefaultPolicy Roles: - Ref: PipelineBuildCodePipelineActionRole PipelineDeployCodePipelineActionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Version: "2012-10-17" PipelineDeployCodePipelineActionRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - codebuild:BatchGetBuilds - codebuild:StartBuild - codebuild:StopBuild Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - ":project/Deploy*" Version: "2012-10-17" PolicyName: PipelineDeployCodePipelineActionRoleDefaultPolicy Roles: - Ref: PipelineDeployCodePipelineActionRole Outputs: PipelineEndpoint: Description: The URL to access the pipeline Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/codesuite/codepipeline/pipelines/${Pipeline}/view?region=${AWS::Region}" ] } } } Type: CODEPIPELINE EncryptionKey: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn {% endfor %} # This role is used to build and publish an image to ECR PublishRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codebuild.amazonaws.com Version: "2012-10-17" PublishRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Effect: Allow Resource: - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/ - Ref: BuildProject - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/ - Ref: BuildProject - :* - Action: - codebuild:CreateReportGroup - codebuild:CreateReport - codebuild:UpdateReport - codebuild:BatchPutTestCases Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :report-group/ - Ref: BuildProject - -* - Action: - ecr:GetAuthorizationToken Effect: Allow Resource: "*" - Action: - ecr:BatchCheckLayerAvailability - ecr:CompleteLayerUpload - ecr:GetAuthorizationToken - ecr:InitiateLayerUpload - ecr:PutImage - ecr:UploadLayerPart Effect: Allow Resource: Fn::GetAtt: - ECRRepo - Arn - Action: - proton:GetService Effect: Allow Resource: "*" - Action: - s3:GetObject* - s3:GetBucket* - s3:List* - s3:DeleteObject* - s3:PutObject* - s3:Abort* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Version: "2012-10-17" PolicyName: PublishRoleDefaultPolicy Roles: - Ref: PublishRole DeploymentRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codebuild.amazonaws.com Version: "2012-10-17" DeploymentRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - logs:CreateLogGroup - logs:CreateLogStream - logs:PutLogEvents Effect: Allow Resource: - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/Deploy*Project* - Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":logs:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :log-group:/aws/codebuild/Deploy*Project:* - Action: - codebuild:CreateReportGroup - codebuild:CreateReport - codebuild:UpdateReport - codebuild:BatchPutTestCases Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - :report-group/Deploy*Project - -* - Action: - proton:UpdateServiceInstance - proton:GetServiceInstance Effect: Allow Resource: "*" - Action: - s3:GetObject* - s3:GetBucket* - s3:List* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Version: "2012-10-17" PolicyName: DeploymentRoleDefaultPolicy Roles: - Ref: DeploymentRole PipelineArtifactsBucketEncryptionKey: Type: AWS::KMS::Key Properties: KeyPolicy: Statement: - Action: - kms:Create* - kms:Describe* - kms:Enable* - kms:List* - kms:Put* - kms:Update* - kms:Revoke* - kms:Disable* - kms:Get* - kms:Delete* - kms:ScheduleKeyDeletion - kms:CancelKeyDeletion - kms:GenerateDataKey - kms:TagResource - kms:UntagResource Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PipelineRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PublishRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - PublishRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:DescribeKey Effect: Allow Principal: AWS: Fn::GetAtt: - DeploymentRole - Arn Resource: "*" - Action: - kms:Decrypt - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Principal: AWS: Fn::GetAtt: - DeploymentRole - Arn Resource: "*" Version: "2012-10-17" UpdateReplacePolicy: Delete DeletionPolicy: Delete PipelineArtifactsBucket: Type: AWS::S3::Bucket Properties: BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: KMSMasterKeyID: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn SSEAlgorithm: aws:kms PublicAccessBlockConfiguration: BlockPublicAcls: true BlockPublicPolicy: true IgnorePublicAcls: true RestrictPublicBuckets: true UpdateReplacePolicy: Retain DeletionPolicy: Retain PipelineArtifactsBucketEncryptionKeyAlias: Type: AWS::KMS::Alias Properties: AliasName: 'alias/codepipeline-encryption-key-{{ service.name }}' # resource parameter TargetKeyId: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn UpdateReplacePolicy: Delete DeletionPolicy: Delete PipelineRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: Service: codepipeline.amazonaws.com Version: "2012-10-17" PipelineRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - s3:GetObject* - s3:GetBucket* - s3:List* - s3:DeleteObject* - s3:PutObject* - s3:Abort* Effect: Allow Resource: - Fn::GetAtt: - PipelineArtifactsBucket - Arn - Fn::Join: - "" - - Fn::GetAtt: - PipelineArtifactsBucket - Arn - /* - Action: - kms:Decrypt - kms:DescribeKey - kms:Encrypt - kms:ReEncrypt* - kms:GenerateDataKey* Effect: Allow Resource: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn - Action: codestar-connections:* Effect: Allow Resource: "*" - Action: sts:AssumeRole Effect: Allow Resource: Fn::GetAtt: - PipelineBuildCodePipelineActionRole - Arn - Action: sts:AssumeRole Effect: Allow Resource: Fn::GetAtt: - PipelineDeployCodePipelineActionRole - Arn Version: "2012-10-17" PolicyName: PipelineRoleDefaultPolicy Roles: - Ref: PipelineRole Pipeline: Type: AWS::CodePipeline::Pipeline Properties: RoleArn: Fn::GetAtt: - PipelineRole - Arn Stages: - Actions: - ActionTypeId: Category: Source Owner: AWS Provider: CodeStarSourceConnection Version: "1" Configuration: ConnectionArn: '{{ service.repository_connection_arn }}' # resource parameter FullRepositoryId: '{{ service.repository_id }}' # resource parameter BranchName: '{{ service.branch_name }}' # resource parameter Name: Checkout OutputArtifacts: - Name: Artifact_Source_Checkout RunOrder: 1 Name: Source - Actions: - ActionTypeId: Category: Build Owner: AWS Provider: CodeBuild Version: "1" Configuration: ProjectName: Ref: BuildProject InputArtifacts: - Name: Artifact_Source_Checkout Name: Build OutputArtifacts: - Name: BuildOutput RoleArn: Fn::GetAtt: - PipelineBuildCodePipelineActionRole - Arn RunOrder: 1 Name: Build {%- for service_instance in service_instances %} - Actions: - ActionTypeId: Category: Build Owner: AWS Provider: CodeBuild Version: "1" Configuration: ProjectName: Ref: Deploy{{loop.index}}Project InputArtifacts: - Name: BuildOutput Name: Deploy RoleArn: Fn::GetAtt: - PipelineDeployCodePipelineActionRole - Arn RunOrder: 1 Name: 'Deploy{{service_instance.name}}' # resource parameter {%- endfor %} ArtifactStore: EncryptionKey: Id: Fn::GetAtt: - PipelineArtifactsBucketEncryptionKey - Arn Type: KMS Location: Ref: PipelineArtifactsBucket Type: S3 DependsOn: - PipelineRoleDefaultPolicy - PipelineRole PipelineBuildCodePipelineActionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Version: "2012-10-17" PipelineBuildCodePipelineActionRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - codebuild:BatchGetBuilds - codebuild:StartBuild - codebuild:StopBuild Effect: Allow Resource: Fn::GetAtt: - BuildProject - Arn Version: "2012-10-17" PolicyName: PipelineBuildCodePipelineActionRoleDefaultPolicy Roles: - Ref: PipelineBuildCodePipelineActionRole PipelineDeployCodePipelineActionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Statement: - Action: sts:AssumeRole Effect: Allow Principal: AWS: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":iam::" - Ref: AWS::AccountId - :root Version: "2012-10-17" PipelineDeployCodePipelineActionRoleDefaultPolicy: Type: AWS::IAM::Policy Properties: PolicyDocument: Statement: - Action: - codebuild:BatchGetBuilds - codebuild:StartBuild - codebuild:StopBuild Effect: Allow Resource: Fn::Join: - "" - - "arn:" - Ref: AWS::Partition - ":codebuild:" - Ref: AWS::Region - ":" - Ref: AWS::AccountId - ":project/Deploy*" Version: "2012-10-17" PolicyName: PipelineDeployCodePipelineActionRoleDefaultPolicy Roles: - Ref: PipelineDeployCodePipelineActionRole Outputs: PipelineEndpoint: Description: The URL to access the pipeline Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/codesuite/codepipeline/pipelines/${Pipeline}/view?region=${AWS::Region}" ``` # CodeBuild 配置模板包 通过 CodeBuild 配置，无需使用 IaC 模板来渲染 IaC 文件并使用 IaC 配置引擎运行它们， AWS Proton 只需运行 shell 命令即可。为此，请在环境帐户中为环境 AWS Proton 创建一个 AWS CodeBuild 项目，然后启动一个作业，在每次创建或更新 AWS Proton 资源时运行您的命令。在您编写模板捆绑包时，您需要提供一个清单，以指定基础设施预置和取消预置命令，以及这些命令可能需要的任何程序、脚本和其他文件。您的命令可以读取 AWS Proton 提供的输入，并负责预置或取消预置基础设施和生成输出值。 清单还指定了 AWS Proton 应如何呈现您的代码可以输入并从中获取输入值的输入文件。可以将该文件渲染为 JSON 或 HCL。有关输入参数的更多信息，请参阅[CodeBuild 配置参数详细信息和示例](parameters-codebuild.md)。有关清单文件的更多信息，请参阅[总结模板文件 AWS Proton](ag-wrap-up.md)。 **注意** 您可以对环境和服务使用 CodeBuild 置备。目前，您无法通过这种方法预置组件。 ## 示例：使用 AWS CDK 带 CodeBuild 配置的 作为使用 CodeBuild 预配的示例，您可以包括使用预配置（*部署*）和取消置备（*销毁*） AWS 资源的代码，以及用于安装 CDK 并运行 CDK 代码的清单。 AWS Cloud Development Kit (AWS CDK) 以下各节列出了您可以包含在 CodeBuild 配置模板包中的示例文件，该模板包使用置备环境 AWS CDK。 ### 清单 以下清单文件指定了 CodeBuild 配置，并包括安装和使用 AWS CDK、输出文件处理和报告输出所需的命令 AWS Proton。 **Example infrastructure/manifest.yaml** ``` infrastructure: templates: - rendering_engine: codebuild settings: image: aws/codebuild/amazonlinux2-x86_64-standard:4.0 runtimes: nodejs: 16 provision: - npm install - npm run build - npm run cdk bootstrap - npm run cdk deploy -- --require-approval never --outputs-file proton-outputs.json - jq 'to_entries | map_values(.value) | add | to_entries | map({key:.key, valueString:.value})' < proton-outputs.json > outputs.json - aws proton notify-resource-deployment-status-change --resource-arn $RESOURCE_ARN --status IN_PROGRESS --outputs file://./outputs.json deprovision: - npm install - npm run build - npm run cdk destroy project_properties: VpcConfig: VpcId: "{{ environment.inputs.codebuild_vpc_id }}" Subnets: "{{ environment.inputs.codebuild_subnets }}" SecurityGroupIds: "{{ environment.inputs.codebuild_security_groups }}" ``` ### 架构 以下架构文件为环境定义参数。您的 AWS CDK 代码可以在部署期间引用这些参数的值。 **Example schema/schema.yaml** ``` schema: format: openapi: "3.0.0" environment_input_type: "MyEnvironmentInputType" types: MyEnvironmentInputType: type: object description: "Input properties for my environment" properties: my_sample_input: type: string description: "This is a sample input" default: "hello world" my_other_sample_input: type: string description: "Another sample input" required: - my_other_sample_input ``` ### AWS CDK 文件 以下文件是一个 Node.js CDK 项目示例。 **Example infrastructure/package.json** ``` { "name": "ProtonEnvironment", "version": "0.1.0", "bin": { "ProtonEnvironmente": "bin/ProtonEnvironment.js" }, "scripts": { "build": "tsc", "watch": "tsc -w", "test": "jest", "cdk": "cdk" }, "devDependencies": { "@types/jest": "^28.1.7", "@types/node": "18.7.6", "jest": "^28.1.3", "ts-jest": "^28.0.8", "aws-cdk": "2.37.1", "ts-node": "^10.9.1", "typescript": "~4.7.4" }, "dependencies": { "aws-cdk-lib": "2.37.1", "constructs": "^10.1.77", "source-map-support": "^0.5.21" } } ``` **Example infrastructure/tsconfig.json** ``` { "compilerOptions": { "target": "ES2018", "module": "commonjs", "lib": [ "es2018" ], "declaration": true, "strict": true, "noImplicitAny": true, "strictNullChecks": true, "noImplicitThis": true, "alwaysStrict": true, "noUnusedLocals": false, "noUnusedParameters": false, "noImplicitReturns": true, "noFallthroughCasesInSwitch": false, "inlineSourceMap": true, "inlineSources": true, "experimentalDecorators": true, "strictPropertyInitialization": false, "resolveJsonModule": true, "esModuleInterop": true, "typeRoots": [ "./node_modules/@types" ] }, "exclude": [ "node_modules", "cdk.out" ] } ``` **Example infrastructure/cdk.json** ``` { "app": "npx ts-node --prefer-ts-exts bin/ProtonEnvironment.ts", "outputsFile": "proton-outputs.json", "watch": { "include": [ "**" ], "exclude": [ "README.md", "cdk*.json", "**/*.d.ts", "**/*.js", "tsconfig.json", "package*.json", "yarn.lock", "node_modules", "test" ] }, "context": { "@aws-cdk/aws-apigateway:usagePlanKeyOrderInsensitiveId": true, "@aws-cdk/core:stackRelativeExports": true, "@aws-cdk/aws-rds:lowercaseDbIdentifier": true, "@aws-cdk/aws-lambda:recognizeVersionProps": true, "@aws-cdk/aws-cloudfront:defaultSecurityPolicyTLSv1.2_2021": true, "@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true, "@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true, "@aws-cdk/core:target-partitions": [ "aws", "aws-cn" ] } } ``` **Example infrastructure/bin/ProtonEnvironment.ts** ``` #!/usr/bin/env node import 'source-map-support/register'; import * as cdk from 'aws-cdk-lib'; import { ProtonEnvironmentStack } from '../lib/ProtonEnvironmentStack'; const app = new cdk.App(); new ProtonEnvironmentStack(app, 'ProtonEnvironmentStack', {}); ``` **Example infrastructure/lib/ProtonEnvironmentStack.ts** ``` import { Stack, StackProps } from 'aws-cdk-lib'; import { Construct } from 'constructs'; import * as cdk from 'aws-cdk-lib'; import * as ssm from 'aws-cdk-lib/aws-ssm'; import input from '../proton-inputs.json'; export class ProtonEnvironmentStack extends Stack { constructor(scope: Construct, id: string, props?: StackProps) { super(scope, id, { ...props, stackName: process.env.STACK_NAME }); const ssmParam = new ssm.StringParameter(this, "ssmParam", { stringValue: input.environment.inputs.my_sample_input, parameterName: `${process.env.STACK_NAME}-Param`, tier: ssm.ParameterTier.STANDARD }) new cdk.CfnOutput(this, 'ssmParamOutput', { value: ssmParam.parameterName, description: 'The name of the ssm parameter', exportName: `${process.env.STACK_NAME}-Param` }); } } ``` ### 渲染的输入文件 当您使用 CodeBuild基于的配置模板创建环境时，会使用您提供的输入[参数值 AWS Proton 呈现一个输入](https://docs.aws.amazon.com/proton/latest/userguide/parameters.html)文件。您的代码可以引用这些值。以下文件是一个渲染的输入文件示例。 **Example infrastructure/proton-inputs.json** ``` { "environment": { "name": "myenv", "inputs": { "my_sample_input": "10.0.0.0/16", "my_other_sample_input": "11.0.0.0/16" } } } ``` # Terraform IaC 文件 学习如何使用 Terraform 基础设施即代码 (IaC) 文件。 AWS Proton[Terraform](https://www.terraform.io/) 是一个广泛使用的开源 IaC 引擎，由开发。[HashiCorp](https://www.hashicorp.com/)Terraform 模块是用 HCL 语言开发 HashiCorp的，支持包括亚马逊 Web Services 在内的多个后端基础设施提供商。 AWS Proton 支持 Terraform IaC 的[自我管理配置](ag-works-prov-methods.md#ag-works-prov-methods-self)。 有关响应拉取请求并实现基础架构配置的配置存储库的完整示例，请参阅上的 [Terraform Acti OpenSource GitHub ons 自动化模板](https://github.com/aws-samples/aws-proton-terraform-github-actions-sample)。 AWS Proton GitHub **自托管式预置如何使用 Terraform IaC 模板捆绑包文件：** 1. 使用 Terraform 模板包[创建环境](ag-create-env.md)时，使用控制台或输入参数 AWS Proton 编译`.tf`文件。`spec file` 1. 它发出拉取请求，将编译的 IaC 文件合并到[您在 AWS Proton中注册的存储库](ag-create-repo.md)。 1. 如果请求获得批准，则 AWS Proton 等待您提供的配置状态。 1. 如果拒绝了该请求，则取消创建环境。 1. 如果拉取请求超时，则*不会* 完成创建环境。 **AWS Proton 考虑到 Terraform IaC 的注意事项：** + AWS Proton 无法管理你的 Terraform 配置。 + 您必须[向注册配置存储库](ag-create-repo.md) AWS Proton。 AWS Proton 对该存储库发出拉取请求。 + 您必须[创建 CodeStar 连接](setting-up-for-service.md#setting-up-vcontrol)才能连接到 AWS Proton 您的配置存储库。 + 要从 AWS Proton 已编译的 IaC 文件中进行配置，您必须响应 AWS Proton 拉取请求。 AWS Proton 在环境和服务创建和更新操作之后发出拉取请求。有关更多信息，请参阅[AWS Proton 环境](ag-environments.md)和[AWS Proton 服务](ag-services.md)。 + 要使用 AWS Proton 已编译的 IaC 文件配置管道，必须[创建 CI/CD 管道存储库](setting-up-for-service.md#setting-up-pr-repo)。 + 基于拉取请求的配置自动化必须包括通知 AWS Proton 任何已配置 AWS Proton 资源状态变化的步骤。你可以使用 AWS Proton [NotifyResourceDeploymentStatusChange API](https://docs.aws.amazon.com/proton/latest/APIReference/API_NotifyResourceDeploymentStatusChange.html)。 + 您无法将从 CloudFormation IaC 文件创建的服务、管道和组件部署到通过 Terraform iaC 文件创建的环境中。 + 您无法将从 Terraform IaC 文件创建的服务、管道和组件部署到通过 IaC 文件创建的环境中。 CloudFormation 在准备 Terraform IaC 文件时 AWS Proton，需要将命名空间附加到输入变量，如以下示例所示。有关更多信息，请参阅[参数](parameters.md)。 ## 示例 1： AWS Proton 环境 Terraform iaC 文件 ``` terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } // This tells terraform to store the state file in s3 at the location // s3://terraform-state-bucket/tf-os-sample/terraform.tfstate backend "s3" { bucket = "terraform-state-bucket" key = "tf-os-sample/terraform.tfstate" region = "us-east-1" } } // Configure the AWS Provider provider "aws" { region = "us-east-1" default_tags { tags = var.proton_tags } } resource "aws_ssm_parameter" "my_ssm_parameter" { name = "my_ssm_parameter" type = "String" // Use the Proton environment.inputs. namespace value = var.environment.inputs.ssm_parameter_value } ``` ## 编译的基础设施即代码 创建环境或服务时，使用控制台或`spec file`输入将基础架构 AWS Proton 编译为代码文件。它为 Terraform 可使用的输入创建 `proton.resource-type.variables.tf` 和 `proton.auto.tfvars.json` 文件，如以下示例中所示。这些文件位于指定存储库中与环境或服务实例名称匹配的文件夹中。 该示例显示了如何在变量定义和变量值中 AWS Proton 包含标签，以及如何将这些 AWS Proton 标签传播到已配置的资源。有关更多信息，请参阅 [标签传播到预置的资源](resources.md#auto-tags-prop)。 ### 示例 2：为名为“dev”的环境编译的 IaC 文件。 **dev/environment.tf：** ``` terraform { required_providers { aws = { source = "hashicorp/aws" version = "~> 3.0" } } // This tells terraform to store the state file in s3 at the location // s3://terraform-state-bucket/tf-os-sample/terraform.tfstate backend "s3" { bucket = "terraform-state-bucket" key = "tf-os-sample/terraform.tfstate" region = "us-east-1" } } // Configure the AWS Provider provider "aws" { region = "us-east-1" default_tags { tags = var.proton_tags } } resource "aws_ssm_parameter" "my_ssm_parameter" { name = "my_ssm_parameter" type = "String" // Use the Proton environment.inputs. namespace value = var.environment.inputs.ssm_parameter_value } ``` **dev/proton.environment.variables.tf：** ``` variable "environment" { type = object({ inputs = map(string) name = string }) } variable "proton_tags" { type = map(string) default = null } ``` **dev/proton.auto.tfvars.json：** ``` { "environment": { "name": "dev", "inputs": { "ssm_parameter_value": "MyNewParamValue" } } "proton_tags" : { "proton:account" : "123456789012", "proton:template" : "arn:aws:proton:us-east-1:123456789012:environment-template/fargate-env", "proton:environment" : "arn:aws:proton:us-east-1:123456789012:environment/dev" } } ``` ## 存储库路径 AWS Proton 使用来自环境或服务创建操作的控制台或规范输入来找到已编译的 IaC 文件的存储库和路径。输入值将传递到[命名空间输入参数](parameters.md)。 AWS Proton 支持两种存储库路径布局。在以下示例中，路径是由两个环境中的命名空间资源参数命名的。每个环境具有两个服务的服务实例，其中的一个服务的服务实例具有直接定义的组件。 [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_cn/proton/latest/userguide/ag-infrastructure-tmp-files-terraform.html) ------ #### [ Layout 1 ] 如果 AWS Proton 找到带有`environments`文件夹的指定存储库，它将创建一个包含已编译的 IaC 文件并以命名的文件夹。`environment.name` 如果在指定的存储库中 AWS Proton 找到的`environments`文件夹包含与服务实例兼容环境名称相匹配的文件夹名称，则它会创建一个包含已编译的实例 IaC 文件并以命名的文件夹。`service_instance.name` ``` /repo /environments /env-prod # environment folder main.tf proton.environment.variables.tf proton.auto.tfvars.json /service-one-instance-one-prod # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /service-two-instance-two-prod # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /component-prod # component folder main.tf proton.component.variables.tf proton.auto.tfvars.json /env-staged # environment folder main.tf proton.variables.tf proton.auto.tfvars.json /service-one-instance-one-staged # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /service-two-instance-two-staged # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /component-staged # component folder main.tf proton.component.variables.tf proton.auto.tfvars.json ``` ------ #### [ Layout 2 ] 如果 AWS Proton 找到没有`environments`文件夹的指定存储库，它将创建一个文件`environment.name`夹，用于查找已编译的环境 IaC 文件。 如果 AWS Proton 找到的指定存储库的文件夹名称与服务实例兼容的环境名称相匹配，它将创建一个`service_instance.name`文件夹，用于查找已编译的实例 IaC 文件。 ``` /repo /env-prod # environment folder main.tf proton.environment.variables.tf proton.auto.tfvars.json /service-one-instance-one-prod # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /service-two-instance-two-prod # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /component-prod # component folder main.tf proton.component.variables.tf proton.auto.tfvars.json /env-staged # environment folder main.tf proton.variables.tf proton.auto.tfvars.json /service-one-instance-one-staged # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /service-two-instance-two-staged # instance folder main.tf proton.service_instance.variables.tf proton.auto.tfvars.json /component-staged # component folder main.tf proton.component.variables.tf proton.auto.tfvars.json ``` ------