如何在CloudFormation子栈中复用主栈模板组件处理多参数场景

Hey there! Let's walk through exactly how to implement this reusable Lambda/role pattern with CloudFormation nested stacks. The key is to create a base child stack template that defines your common resources, then use a parent stack to instantiate multiple copies with different parameters (like your PolicyNames).

Step 1: Build the Reusable Base Child Stack Template #

This template will contain your generic Lambda function and execution role, with all variable details exposed as CloudFormation parameters. This way, every time you deploy this stack, you can pass in unique values for things like policy names, function names, or code locations.

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  LambdaFunctionName:
    Type: String
    Description: Unique name for your Lambda function
  LambdaRuntime:
    Type: String
    Default: python3.9
    Description: Runtime environment for the Lambda function
  PolicyNames:
    Type: CommaDelimitedList
    Description: Comma-separated list of IAM managed policy names to attach to the execution role
  LambdaHandler:
    Type: String
    Description: Handler path (e.g., `index.lambda_handler`)
  LambdaCodeS3Bucket:
    Type: String
    Description: S3 bucket holding your Lambda code zip
  LambdaCodeS3Key:
    Type: String
    Description: S3 key for the Lambda code zip file

Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      # Convert policy names to full ARNs
      ManagedPolicyArns: !Split 
        - ","
        - !Join 
          - ","
          - !Sub 
            - "arn:aws:iam::aws:policy/${Policy}"
            - Policy: !Join [",", !Ref PolicyNames]
      Path: /

  LambdaFunction:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Ref LambdaFunctionName
      Runtime: !Ref LambdaRuntime
      Role: !GetAtt LambdaExecutionRole.Arn
      Handler: !Ref LambdaHandler
      Code:
        S3Bucket: !Ref LambdaCodeS3Bucket
        S3Key: !Ref LambdaCodeS3Key
      Timeout: 30

# Add outputs so parent stacks can reference these resources
Outputs:
  LambdaFunctionArn:
    Value: !GetAtt LambdaFunction.Arn
    Export:
      Name: !Sub "${AWS::StackName}-LambdaArn"
  LambdaExecutionRoleArn:
    Value: !GetAtt LambdaExecutionRole.Arn

Step 2: Create the Parent Stack to Instantiate Multiple Instances #

Now, use a parent stack to deploy multiple copies of the base child stack, each with its own unique parameters. This is where you define your different scenarios (e.g., one Lambda for data processing, another for notifications).

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BaseLambdaStackTemplateURL:
    Type: String
    Description: S3 URL of your base Lambda child stack template (e.g., `https://your-bucket.s3.amazonaws.com/base-lambda-stack.yaml`)
  CommonCodeS3Bucket:
    Type: String
    Description: S3 bucket with your shared Lambda code assets

Resources:
  # Scenario 1: User Data Processing Lambda
  UserProcessingLambdaStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Ref BaseLambdaStackTemplateURL
      Parameters:
        LambdaFunctionName: UserProcessingFunction
        PolicyNames: AmazonS3ReadOnlyAccess,AmazonDynamoDBFullAccess
        LambdaHandler: user_processor.lambda_handler
        LambdaCodeS3Bucket: !Ref CommonCodeS3Bucket
        LambdaCodeS3Key: user-processing-code.zip

  # Scenario 2: Notification Sender Lambda
  NotificationLambdaStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: !Ref BaseLambdaStackTemplateURL
      Parameters:
        LambdaFunctionName: NotificationFunction
        PolicyNames: AmazonSNSFullAccess
        LambdaHandler: notification_sender.lambda_handler
        LambdaCodeS3Bucket: !Ref CommonCodeS3Bucket
        LambdaCodeS3Key: notification-code.zip

Bonus Tips for Flexibility & Best Practices #

• Handle Custom Policies: If you need custom inline policies instead of managed ones, add a CustomPolicyDocument parameter to the base stack and use it in the LambdaExecutionRole resource's Policies property.
• Reuse Common Values: Use CloudFormation Mappings or Parameters with defaults in the parent stack to avoid repeating values like runtime across child stacks.
• Reference Child Stack Resources: Use !GetAtt <ChildStackName>.Outputs.<OutputName> in the parent stack to reference resources from child stacks (e.g., linking a Lambda to an EventBridge rule).
• Store Templates in S3: Nested stack templates must be hosted in S3 (or a publicly accessible URL), so make sure your base template is uploaded to an S3 bucket with appropriate permissions.

内容的提问来源于stack exchange，提问作者claudiadast