如何在CloudFormation中为ElasticBeanstalk多容器环境添加ECR和DynamoDB权限

1. 给MyInstanceProfile附加所需权限 #

MyInstanceProfile直接关联了IAM角色MyInstanceRole，你只需要给MyInstanceRole新增内联策略，添加ECR拉取镜像和DynamoDB操作的权限即可，权限说明如下：

• ECR拉取镜像所需权限动作：ecr:GetDownloadUrlForLayer、ecr:BatchGetImage、ecr:BatchCheckLayerAvailability、ecr:GetAuthorizationToken
• DynamoDB操作权限可根据你的业务需求配置，常见读写权限动作包含dynamoDB:PutItem、dynamoDB:GetItem、dynamoDB:Scan、dynamoDB:Query、dynamoDB:UpdateItem、dynamoDB:DeleteItem

2. CloudFormation模板新增资源 #

2.1 新增ECR仓库（可选，你已有仓库可跳过） #

新增类型为AWS::ECR::Repository的资源块，即可自动创建ECR镜像仓库，创建后你需要将本地镜像推送到该仓库，同时替换Dockerrun.json里的web服务镜像地址为新仓库的地址。

2.2 新增DynamoDB表 #

新增类型为AWS::DynamoDB::Table的资源块，按需配置表名、分区键、排序键（可选）、读写容量模式即可。

3. 完整修改后的CloudFormation模板示例 #

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  # 可选：新增ECR镜像仓库，已有仓库可删除该资源块
  TravelTouchECRRepository:
    Type: AWS::ECR::Repository
    Properties:
      RepositoryName: traveltouch
      ImageScanningConfiguration:
        scanOnPush: true
      ImageTagMutability: MUTABLE

  # 新增DynamoDB表，可按需修改表名、主键、读写容量等配置
  TravelTouchDynamoTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: traveltouch_table
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5

  sampleApplication:
    Type: AWS::ElasticBeanstalk::Application
    Properties:
      Description: AWS Elastic Beanstalk Sample Application
  sampleApplicationVersion:
    Type: AWS::ElasticBeanstalk::ApplicationVersion
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Application Version
      SourceBundle:
        S3Bucket: !Sub "elasticbeanstalk-ap-south-1-182107200133"
        S3Key: TravelTouch/Dockerrun.aws.json
  sampleConfigurationTemplate:
    Type: AWS::ElasticBeanstalk::ConfigurationTemplate
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Configuration Template
      OptionSettings:
      - Namespace: aws:autoscaling:asg
        OptionName: MinSize
        Value: '2'
      - Namespace: aws:autoscaling:asg
        OptionName: MaxSize
        Value: '6'
      - Namespace: aws:elasticbeanstalk:environment
        OptionName: EnvironmentType
        Value: LoadBalanced
      - Namespace: aws:autoscaling:launchconfiguration
        OptionName: IamInstanceProfile
        Value: !Ref MyInstanceProfile        
      SolutionStackName: 64bit Amazon Linux 2018.03 v2.26.0 running Multi-container Docker 19.03.13-ce (Generic)
  sampleEnvironment:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName:
        Ref: sampleApplication
      Description: AWS ElasticBeanstalk Sample Environment
      TemplateName:
        Ref: sampleConfigurationTemplate
      VersionLabel:
        Ref: sampleApplicationVersion
  MyInstanceRole:
    Type: AWS::IAM::Role
    Properties: 
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Description: Beanstalk EC2 role
      ManagedPolicyArns: 
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
        - arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
      # 新增内联策略，添加ECR和DynamoDB访问权限
      Policies:
        - PolicyName: ECRAndDynamoDBAccess
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              # ECR拉取镜像权限
              - Effect: Allow
                Action:
                  - ecr:GetAuthorizationToken
                  - ecr:BatchCheckLayerAvailability
                  - ecr:GetDownloadUrlForLayer
                  - ecr:BatchGetImage
                Resource: "*"
              # DynamoDB操作权限，可按需调整允许的动作和资源范围
              - Effect: Allow
                Action:
                  - dynamodb:PutItem
                  - dynamodb:GetItem
                  - dynamodb:Scan
                  - dynamodb:Query
                  - dynamodb:UpdateItem
                  - dynamodb:DeleteItem
                Resource: !GetAtt TravelTouchDynamoTable.Arn
  MyInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties: 
      Roles:
        - !Ref MyInstanceRole

4. Dockerrun.json调整说明 #

如果你使用模板新建的ECR仓库，只需要把web容器的image字段替换为新建ECR仓库的地址即可，仓库地址格式为[你的AWS账号ID].dkr.ecr.ap-south-1.amazonaws.com/traveltouch:latest。如果你使用原有ECR仓库，不需要修改Dockerrun.json配置。

内容的提问来源于stack exchange，提问作者Natheeshkumar Rangasamy