AWS CDK中QuickSight资源依赖S3部署报错求助

错误根源 #

quicksightDatasource.addDependsOn() 要求传入CfnResource类型的参数，但BucketDeployment是CDK的L2高层构造类，并非直接的CloudFormation资源对象，因此出现类型不匹配报错。

解决方案 #

1. 修正依赖引用逻辑 #

将quicksightDatasource.addDependsOn(bucketDeployment)替换为：

quicksightDatasource.addDependsOn(bucketDeployment.node.defaultChild as cdk.CfnResource)

bucketDeployment.node.defaultChild会返回该L2构造对应的底层CloudFormation资源（即AWS::S3::BucketDeployment），通过类型断言转换为CfnResource即可满足参数要求，确保QuickSight数据源在文件上传完成后再创建。

2. 配置QuickSight的S3访问权限 #

即使文件上传完成，若QuickSight无S3桶的读取权限，仍会出现文件找不到的问题。需为QuickSight服务角色添加S3桶的读取权限：

• 若你已显式创建QuickSight角色：

// 假设quicksightRole是你创建的QuickSight服务角色
quicksightBucket.grantRead(quicksightRole);

• 若使用默认QuickSight角色，可通过资源策略实现：

const s3ReadPolicy = new iam.PolicyStatement({
  actions: ["s3:GetObject", "s3:ListBucket"],
  resources: [
    quicksightBucket.bucketArn,
    `${quicksightBucket.bucketArn}/*`
  ],
  principals: new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/service-role/AmazonQuickSightAccessForS3StorageManagement`),
});

quicksightBucket.addToResourcePolicy(s3ReadPolicy);

修改后的完整代码示例 #

const { Stack, RemovalPolicy, CfnResource } = require('aws-cdk-lib');
const s3 = require('aws-cdk-lib/aws-s3');
const s3deploy = require('aws-cdk-lib/aws-s3-deployment');
const quicksight = require('aws-cdk-lib/aws-quicksight');
const iam = require('aws-cdk-lib/aws-iam');

class YourStack extends Stack {
  constructor(scope, id, props) {
    super(scope, id, props);

    const quicksightBucket = new s3.Bucket(this, "userS3Bucket", {
      bucketName: "quicksight-bucket-user",
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
      versioned: true,
      removalPolicy: RemovalPolicy.DESTROY,
      autoDeleteObjects: true,
    });

    const bucketDeployment = new s3deploy.BucketDeployment(
      this,
      "bucketDeployment",
      {
        destinationBucket: quicksightBucket,
        sources: [
          s3deploy.Source.asset("/Users/user/Downloads/housing"),
        ],
      }
    );

    const quicksightDatasource = new quicksight.CfnDataSource(
      this,
      "quicksight-datasource",
      {
        name: "quicksightdatasource",
        awsAccountId: cdk.Aws.ACCOUNT_ID, // 用CDK内置变量替代硬编码账号ID
        dataSourceId: "7217623409123897423687",
        type: "S3",
        dataSourceParameters: {
          s3Parameters: {
            manifestFileLocation: {
              bucket: quicksightBucket.bucketName,
              key: "manifest.json",
            },
          },
        },
      }
    );

    // 修正依赖引用
    quicksightDatasource.addDependsOn(bucketDeployment.node.defaultChild as CfnResource);

    // 添加QuickSight的S3读取权限
    const s3ReadPolicy = new iam.PolicyStatement({
      actions: ["s3:GetObject", "s3:ListBucket"],
      resources: [
        quicksightBucket.bucketArn,
        `${quicksightBucket.bucketArn}/*`
      ],
      principals: new iam.ArnPrincipal(`arn:aws:iam::${cdk.Aws.ACCOUNT_ID}:role/service-role/AmazonQuickSightAccessForS3StorageManagement`),
    });
    quicksightBucket.addToResourcePolicy(s3ReadPolicy);
  }
}

module.exports = { YourStack };

额外提醒 #

• 避免硬编码AWS账号ID，改用cdk.Aws.ACCOUNT_ID获取当前部署环境的账号ID，提升代码可移植性。
• 确认本地/Users/user/Downloads/housing目录下确实存在manifest.json文件，且路径无误。

内容的提问来源于stack exchange，提问作者gospecomid12