AWS CDK（TypeScript）中如何配置PatchBaseline的ApprovalRules？（附Python代码转TypeScript需求）

我明白你在把Python的CDK代码转成TypeScript时遇到的困境——TypeScript里没法像Python那样实例化RuleProperty类对吧？这是因为两种语言在CDK的属性定义方式上有区别：Python用类实例来构建Cfn资源的属性，而TypeScript靠对象字面量+类型接口来约束结构，不需要实例化任何XXProperty类。

下面是你提供的Python代码对应的TypeScript实现（分Cfn级别和更推荐的L2构造两种方式）：

方式一：使用Cfn级别的构造（对应你原Python代码的直接转换） #

import * as ssm from '@aws-cdk/aws-ssm';
import { Construct } from '@aws-cdk/core';

export class YourStack extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    // 1. 定义补丁过滤器组
    const patchBaselinePatchFilterGroup: ssm.CfnPatchBaseline.PatchFilterGroupProperty = {
      patchFilters: [
        {
          key: 'PRODUCT',
          values: ['AmazonLinux2']
        },
        {
          key: 'CLASSIFICATION',
          values: ['Critical']
        }
        // 根据你的需求添加更多过滤器规则
      ]
    };

    // 2. 定义单个审批规则
    const patchBaselineRule: ssm.CfnPatchBaseline.RuleProperty = {
      approveAfterDays: 0,
      complianceLevel: 'CRITICAL',
      enableNonSecurity: true,
      patchFilterGroup: patchBaselinePatchFilterGroup
    };

    // 3. 定义规则组
    const patchBaselineRuleGroup: ssm.CfnPatchBaseline.RuleGroupProperty = {
      patchRules: [patchBaselineRule]
    };

    // 4. 创建PatchBaseline
    const patchBaseline = new ssm.CfnPatchBaseline(this, 'rPatchBaseline', {
      name: 'TestPatchBaseline_Linux',
      description: 'TestPatchBaseline for Linux updates, Amazon_Linux_2 distr.',
      operatingSystem: 'AMAZON_LINUX_2',
      approvedPatchesEnableNonSecurity: true,
      patchGroups: ['AWS-Linux-2-Test'],
      approvalRules: patchBaselineRuleGroup
    });
  }
}

方式二：使用更推荐的L2构造（类型更安全，写法更简洁） #

CDK的L2构造（ssm.PatchBaseline）封装了底层的Cfn逻辑，还提供了枚举类型避免字符串拼写错误，更符合TypeScript的开发习惯：

import * as ssm from '@aws-cdk/aws-ssm';
import { Construct } from '@aws-cdk/core';

export class YourStack extends Construct {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const patchBaseline = new ssm.PatchBaseline(this, 'rPatchBaseline', {
      baselineName: 'TestPatchBaseline_Linux',
      description: 'TestPatchBaseline for Linux updates, Amazon_Linux_2 distr.',
      operatingSystem: ssm.OperatingSystemType.AMAZON_LINUX_2,
      approvedPatchesEnableNonSecurity: true,
      patchGroups: ['AWS-Linux-2-Test'],
      approvalRules: {
        patchRules: [
          {
            approveAfterDays: 0,
            complianceLevel: ssm.PatchComplianceLevel.CRITICAL,
            enableNonSecurity: true,
            patchFilterGroup: {
              patchFilters: [
                {
                  key: ssm.PatchFilterKey.PRODUCT,
                  values: ['AmazonLinux2']
                },
                {
                  key: ssm.PatchFilterKey.CLASSIFICATION,
                  values: ['Critical']
                }
              ]
            }
          }
        ]
      }
    });
  }
}

为什么你的原代码报错？ #

在TypeScript版本的AWS CDK中，ssm.CfnPatchBaseline并没有名为RuleProperty的类——这个名字对应的是类型接口，用来提示编译器属性的结构，而不是可实例化的类。你只需要创建符合该接口结构的普通对象即可，不需要用new关键字。

内容的提问来源于stack exchange，提问作者FilipKamenar