使用CDK配置S3桶策略与EventBridge通知时部署间歇性失败求助

这个问题是因为CloudFormation同时执行PutBucketPolicy和PutBucketNotificationConfiguration操作，触发S3的并发操作限制导致的。以下是几种可行的修复方法：

方法1：给资源添加显式依赖 #

利用CDK的依赖管理机制，让桶通知的操作等待桶策略配置完成后再执行，避免并发冲突。

代码示例：

// 添加桶策略并获取策略资源
const policyResult = this.s3Bucket.addToResourcePolicy(
  createS3BucketSSLRequestsOnlyPolicyStatement(this.s3Bucket.bucketArn)
);

// 找到桶对应的CfnBucketNotification资源
const bucketNotification = this.s3Bucket.node.children.find(
  child => child instanceof s3.CfnBucketNotification
) as s3.CfnBucketNotification;

// 让通知资源依赖于桶策略
if (policyResult?.policy && bucketNotification) {
  bucketNotification.addDependency(policyResult.policy);
}

方法2：使用L1构造手动控制部署顺序 #

放弃L2的s3.Bucket封装，直接用L1的CfnBucket、CfnBucketPolicy、CfnBucketNotification构造，显式设置资源间的依赖关系，完全控制操作顺序。

代码示例：

// 创建基础S3桶（L1构造）
const cfnBucket = new s3.CfnBucket(this, 'Bucket', {
  encryptionConfiguration: {
    serverSideEncryptionConfiguration: [
      {
        serverSideEncryptionByDefault: {
          kmsMasterKeyId: encryptionKey.keyArn,
          sseAlgorithm: 'aws:kms'
        }
      }
    ]
  },
  notificationConfiguration: {
    eventBridgeConfiguration: { eventBridgeEnabled: true }
  },
  removalPolicy: cdk.RemovalPolicy.DESTROY
});

// 创建桶策略并依赖于桶
const bucketPolicy = new s3.CfnBucketPolicy(this, 'BucketPolicy', {
  bucket: cfnBucket.ref,
  policyDocument: {
    Version: '2012-10-17',
    Statement: [createS3BucketSSLRequestsOnlyPolicyStatement(cfnBucket.attrArn)]
  }
});
bucketPolicy.addDependency(cfnBucket);

// 创建EventBridge通知并依赖于桶策略
const bucketNotification = new s3.CfnBucketNotification(this, 'BucketNotification', {
  bucket: cfnBucket.ref,
  eventBridgeConfiguration: { eventBridgeEnabled: true }
});
bucketNotification.addDependency(bucketPolicy);

方法3：增强自定义资源的重试策略 #

S3的PutBucketNotificationConfiguration操作由CDK的自定义资源执行，通过增加重试次数和延迟，让CloudFormation在遇到冲突时自动重试，降低部署失败概率。

代码示例：

// 找到桶的通知自定义资源
const bucketNotification = this.s3Bucket.node.children.find(
  child => child instanceof s3.CfnBucketNotification
) as s3.CfnBucketNotification;

// 配置重试参数
if (bucketNotification) {
  bucketNotification.cfnOptions.metadata = {
    'AWS::CloudFormation::CustomResource': {
      RetryAttempts: 5,
      RetryDelaySeconds: 10
    }
  };
}

内容的提问来源于stack exchange，提问作者Shanika Ediriweera