CodeBuild无法创建日志

Question

我有以下作用，为我CodeBuild服务，通过CloudFormation

CodeBuildRole: 
    Type: AWS::IAM::Role 
    Properties: 
     RoleName: !Sub '${PipelineName}-codebuild' 
     AssumeRolePolicyDocument: 
     Version: '2012-10-17' 
     Statement: 
      Effect: Allow 
      Principal: 
      Service: codebuild.amazonaws.com 
      Action: sts:AssumeRole 
     Policies: 
     - PolicyName: !Sub '${PipelineName}-codebuild' 
      PolicyDocument: 
      Version: '2012-10-17' 
      Statement: 
       - Effect: Allow 
       Resource: 
       - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}' 
       - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}/*' 
       Action: 
       - 'logs:CreateLogGroup' 
       - 'logs:CreateLogStream' 
       - 'logs:PutLogEvents' 
       - Effect: Allow 
       Resource: 
        - !Sub 'arn:aws:s3:::codepipeline-${AWS::Region}-*/*' 
       Action: 
        - 's3:GetObject' 
        - 's3:GetObjectVersion' 
        - 's3:PutObject' 
       - Effect: Allow 
       Resource: 
        - !GetAtt [PipelineArtifactStore, Arn] 
       Action: 
        - 's3:PutObject' 

产生哪些错误与

- !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}' 
- !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}/*' 

为什么不能CodeBuild写日志？

服务角色ARN：AWS：IAM :: 598xxx：角色/天网codebuild不允许 AWS CodeBuild创建构建 阿尔恩亚马逊CloudWatch的日志日志流：AWS：codebuild：AP-东南-1： 598xxx：编译/天网 - 拉姆达：544xxx-aa88945844fa。 错误消息：用户： arn：aws：sts :: 598xxx：假设角色/ skynet-codebuild/AWSCodeBuild-544xxx-aa88945844fa 未被授权执行：logs：CreateLogStream on resource： arn：aws：logs：ap -southeast-1：598xxx：登录组：/ AWS/codebuild /天网 - 拉姆达：日志流：544xxx-aa88945844fa。 服务角色arn：aws：iam :: 598xxx：role/skynet-codebuild不允许 AWS CodeBuild创建Amazon CloudWatch Logs日志流以生成 arn：aws：codebuild：ap-southeast-1：598xxx：build/skynet -Lambda：544xxx-aa88945844fa。 错误消息：用户： arn：aws：sts :: 598xxx：假设角色/ skynet-codebuild/AWSCodeBuild-544xxx-aa88945844fa 未被授权执行：logs：CreateLogStream on resource： arn：aws：logs：ap -southeast-1：598xxx：登录组：/ AWS/codebuild /天网 - 拉姆达：日志流：544xxx-aa88945844fa

更新：为参考全部cloudformation模板

AWSTemplateFormatVersion : '2010-09-09' 
Description: 'Skynet stack for CodePipeline' 

Parameters: 
    PipelineName: 
    Type: String 
    Description: Pipeline Name (Lower case only, since S3 bucket names can only have lowercase) 
    Default: skynet 
    GitHubOwner: 
    Type: String 
    Description: GitHub Owner/Username 
    GitHubRepo: 
    Type: String 
    Description: GitHub Repo 
    Default: '2359media/skynet' 
    GitHubBranch: 
    Type: String 
    Description: GitHub Branch 
    Default: master 
    GitHubToken: 
    Type: String 
    Description: GitHub Token 
    NoEcho: true 

Resources: 
    Pipeline: 
    Type: AWS::CodePipeline::Pipeline 
    Properties: 
     Name: !Ref PipelineName 
     RoleArn: !GetAtt [PipelineRole, Arn] 
     ArtifactStore: 
     Location: !Ref PipelineArtifactStore 
     Type: S3 
     DisableInboundStageTransitions: [] 
     Stages: 
     - Name: GitHubSource 
      Actions: 
      - Name: Source 
      ActionTypeId: 
       Category: Source 
       Owner: ThirdParty 
       Version: 1 
       Provider: GitHub 
      Configuration: 
       Owner: !Ref GitHubOwner 
       Repo: !Ref GitHubRepo 
       Branch: !Ref GitHubBranch 
       OAuthToken: !Ref GitHubToken 
      OutputArtifacts: 
       - Name: SourceCode 
     - Name: Build 
      Actions: 
      - Name: Lambda 
      InputArtifacts: 
       - Name: SourceCode 
      OutputArtifacts: 
       - Name: LambdaPackage 
      ActionTypeId: 
       Category: Build 
       Owner: AWS 
       Version: 1 
       Provider: CodeBuild 
      Configuration: 
       ProjectName: !Ref CodeBuildLambda 
     - Name: Deploy 
      Actions: 
      - Name: Lambda 
      InputArtifacts: 
       - Name: LambdaPackage 
      OutputArtifacts: 
       - Name: LambdaDeployment 
      ActionTypeId: 
       Category: Deploy 
       Owner: AWS 
       Version: 1 
       Provider: CloudFormation 
      Configuration: 
       ActionMode: CHANGE_SET_REPLACE 
       RoleArn: !GetAtt [CloudFormationRole, Arn] 
       StackName: !Ref AWS::StackName 
       TemplatePath: 'Template::lambda/sam.yml' 

    CodeBuildLambda: 
    Type: AWS::CodeBuild::Project 
    Properties: 
     Name: !Sub '${PipelineName}-lambda' 
     Artifacts: 
     Type: CODEPIPELINE 
     Environment: 
     ComputeType: BUILD_GENERAL1_SMALL 
     Image: aws/codebuild/nodejs:7.0.0 
     Type: LINUX_CONTAINER 
     EnvironmentVariables: 
      - Name: S3_BUCKET 
      Value: !Ref PipelineArtifactStore 
     ServiceRole: !Ref CodeBuildRole 
     Source: 
     BuildSpec: 'lambda/buildspec.yml' 
     Type: CODEPIPELINE 

    PipelineArtifactStore: 
    Type: AWS::S3::Bucket 
    Properties: 
     BucketName: !Sub '${PipelineName}-pipeline-artifacts' 
     VersioningConfiguration: 
     Status: Enabled 

    CodeBuildRole: 
    Type: AWS::IAM::Role 
    Properties: 
     RoleName: !Sub '${PipelineName}-codebuild' 
     AssumeRolePolicyDocument: 
     Version: '2012-10-17' 
     Statement: 
      Effect: Allow 
      Principal: 
      Service: codebuild.amazonaws.com 
      Action: sts:AssumeRole 
     Policies: 
     - PolicyName: !Sub '${PipelineName}-codebuild' 
      PolicyDocument: 
      Version: '2012-10-17' 
      Statement: 
       - Effect: Allow 
       Resource: 
       - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*' 
       Action: 
       - 'logs:CreateLogGroup' 
       - 'logs:CreateLogStream' 
       - 'logs:PutLogEvents' 
       - Effect: Allow 
       Resource: 
        - !Sub 'arn:aws:s3:::codepipeline-${AWS::Region}-*/*' 
        - !Sub 
        - '${PipelineArtifactStoreArn}/*' 
        - {PipelineArtifactStoreArn: !GetAtt [PipelineArtifactStore, Arn]} 
       Action: 
        - 's3:GetObject' 
        - 's3:GetObjectVersion' 
        - 's3:PutObject' 

    CloudFormationRole: 
    Type: AWS::IAM::Role 
    Properties: 
     RoleName: !Sub '${PipelineName}-cloudformation' 
     AssumeRolePolicyDocument: 
     Version: '2012-10-17' 
     Statement: 
     - Effect: Allow 
      Principal: 
      Service: cloudformation.amazonaws.com 
      Action: 
      - sts:AssumeRole 
     Path:/
     ManagedPolicyArns: 
     - 'arn:aws:iam::aws:policy/AWSLambdaExecute' 
     Policies: 
     - PolicyName: !Sub '${PipelineName}-cloudformation' 
      PolicyDocument: 
      Version: '2012-10-17' 
      Statement: 
       - Effect: Allow 
       Resource: '*' 
       Action: 
       - 's3:GetObject' 
       - 's3:GetObjectVersion' 
       - 's3:GetBucketVersioning' 
       - Effect: Allow 
       Resource: 'arn:aws:s3:::codepipeline*' 
       Action: 
       - 's3:PutObject' 
       - Effect: Allow 
       Resource: !Sub 'arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:*' 
       Action: 
       - 'lambda:*' 
       - Effect: Allow 
       Resource: !Sub 'arn:aws:apigateway:${AWS::Region}::*' 
       Action: 
       - 'apigateway:*' 
       - Effect: Allow 
       Resource: !Sub 'arn:aws:iam::${AWS::Region}:role/*' 
       Action: 
       - 'iam:GetRole' 
       - 'iam:CreateRole' 
       - 'iam:DeleteRole' 
       - 'iam:AttachRolePolicy' 
       - 'iam:DetachRolePolicy' 
       - Effect: Allow 
       Resource: '*' 
       Action: 
       - 'iam:PassRole' 
       - Effect: Allow 
       Resource: !Sub 'arn:aws:cloudformation:${AWS::Region}:aws:transform/Serverless-2016-10-31' 
       Action: 
       - 'cloudformation:CreateChangeSet' 

    PipelineRole: 
    Type: AWS::IAM::Role 
    Properties: 
     RoleName: !Sub '${PipelineName}-pipeline' 
     AssumeRolePolicyDocument: 
     Version: '2012-10-17' 
     Statement: 
     - Action: ['sts:AssumeRole'] 
      Effect: Allow 
      Principal: 
      Service: [codepipeline.amazonaws.com] 
     Path:/
     Policies: 
     - PolicyName: SkynetPipeline 
      PolicyDocument: 
      Version: '2012-10-17' 
      Statement: 
       - Action: 
       - 's3:GetObject' 
       - 's3:GetObjectVersion' 
       - 's3:GetBucketVersioning' 
       Effect: 'Allow' 
       Resource: '*' 
       - Action: 
       - 's3:PutObject' 
       Effect: 'Allow' 
       Resource: 
       - !GetAtt [PipelineArtifactStore, Arn] 
       - Action: 
       - 'codecommit:CancelUploadArchive' 
       - 'codecommit:GetBranch' 
       - 'codecommit:GetCommit' 
       - 'codecommit:GetUploadArchiveStatus' 
       - 'codecommit:UploadArchive' 
       Effect: 'Allow' 
       Resource: '*' 
       - Action: 
       - 'codedeploy:CreateDeployment' 
       - 'codedeploy:GetApplicationRevision' 
       - 'codedeploy:GetDeployment' 
       - 'codedeploy:GetDeploymentConfig' 
       - 'codedeploy:RegisterApplicationRevision' 
       Effect: 'Allow' 
       Resource: '*' 
       - Action: 
       - 'elasticbeanstalk:*' 
       - 'ec2:*' 
       - 'elasticloadbalancing:*' 
       - 'autoscaling:*' 
       - 'cloudwatch:*' 
       - 's3:*' 
       - 'sns:*' 
       - 'cloudformation:*' 
       - 'rds:*' 
       - 'sqs:*' 
       - 'ecs:*' 
       - 'iam:PassRole' 
       Effect: 'Allow' 
       Resource: '*' 
       - Action: 
       - 'lambda:InvokeFunction' 
       - 'lambda:ListFunctions' 
       Effect: 'Allow' 
       Resource: '*' 
       - Action: 
       - 'opsworks:CreateDeployment' 
       - 'opsworks:DescribeApps' 
      - 'opsworks:DescribeCommands' 
      - 'opsworks:DescribeDeployments' 
      - 'opsworks:DescribeInstances' 
      - 'opsworks:DescribeStacks' 
      - 'opsworks:UpdateApp' 
      - 'opsworks:UpdateStack' 
      Effect: 'Allow' 
      Resource: '*' 
      - Action: 
      - 'cloudformation:CreateStack' 
      - 'cloudformation:DeleteStack' 
      - 'cloudformation:DescribeStacks' 
      - 'cloudformation:UpdateStack' 
      - 'cloudformation:CreateChangeSet' 
      - 'cloudformation:DeleteChangeSet' 
      - 'cloudformation:DescribeChangeSet' 
      - 'cloudformation:ExecuteChangeSet' 
      - 'cloudformation:SetStackPolicy' 
      - 'cloudformation:ValidateTemplate' 
      - 'iam:PassRole' 
      Effect: 'Allow' 
      Resource: '*' 
      - Action: 
      - 'codebuild:BatchGetBuilds' 
      - 'codebuild:StartBuild' 
      Effect: 'Allow' 
      Resource: '*' 

Answer 1

它似乎你给的价值可能会有细微的差异角色和它所期望的价值。

看来您正在创建基于${PipelineName}-codebuild的名称，该名称似乎解析为skynet-codebuild，因此基于此，您的PipelineName是skynet。在您的政策中，您可以访问logs:CreateLogGroup获取资源arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}。从我可以从你的错误应该得到的应该是arn:aws:logs:ap-southeast-1:598xxx:log-group:/aws/codebuild/skynet:log-stream:...，但实际上是arn:aws:logs:ap-southeast-1:598xxx:log-group:/aws/codebuild/skynet-lambda:log-stream:...

是否有可能您的CodeBuild项目实际上被称为${PipelineName}-lambda？你也许能够解决这个问题更容易的方法之一是使用声明的政策，如：

- Effect: Allow 
    Resource: 
    - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}-*' 
    - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}-*/*' 
    Action: 
    - 'logs:CreateLogGroup' 
    - 'logs:CreateLogStream' 

应该让你的CodeBuild到其中CodeBuild与PipelineName-的名字开始创建LogGroups和LogStreams。

更新：感谢您的完整CloudFormation模板。正如预期的那样，您的CodeBuild项目名为${PipelineName}-lambda，这就是为什么您的策略不匹配。如果您想授权为该项目创建日志，则需要用以下语句替换您的语句：

- Effect: Allow 
    Resource: 
    - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}-lambda' 
    - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/codebuild/${PipelineName}-lambda/*' 
    Action: 
    - 'logs:CreateLogGroup' 
    - 'logs:CreateLogStream'