@gomi_ningen's Website

SNS-Kinesis Firehose-S3 連携の CloudFormation テンプレート

Amazon SNS トピックに対して Kinesis Firehose ストリームをエンドポイントとするサブスクリプションを作成できるようになったので手早くこれを構成するための CloudFormation テンプレートをメモしておく。

作成する必要があるリソースは以下の通り

  • S3 バケット
  • SNS トピック
  • Subscription
  • Subscription 用のロール
  • Kinesis Firehose Delivery Stream
  • Delivery Stream 用の IAM ポリシー
  • Delivery Stream 用の IAM ロール
AWSTemplateFormatVersion: '2010-09-09' Transform: AWS::Serverless-2016-10-31 Resources: TestBucket: Type: AWS::S3::Bucket DeletionPolicy: Delete TestTopic: Type: AWS::SNS::Topic TestTopicKinesisSubscription: Type: AWS::SNS::Subscription Properties: TopicArn: !Ref TestTopic Endpoint: !GetAtt TestDeliveryStream.Arn Protocol: firehose RawMessageDelivery: true SubscriptionRoleArn: !GetAtt TestTopicKinesisSubscriptionRole.Arn TestTopicKinesisSubscriptionRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: '2012-10-17' Statement: - Effect: Allow Principal: Service: - sns.amazonaws.com Action: - sts:AssumeRole Policies: - PolicyName: SNSKinesisFirehoseAccessPolicy PolicyDocument: Version: '2012-10-17' Statement: - Action: - firehose:DescribeDeliveryStream - firehose:ListDeliveryStreams - firehose:ListTagsForDeliveryStream - firehose:PutRecord - firehose:PutRecordBatch Effect: Allow Resource: - !GetAtt TestDeliveryStream.Arn TestDeliveryStream: DependsOn: - TestDeliveryPolicy Type: AWS::KinesisFirehose::DeliveryStream Properties: ExtendedS3DestinationConfiguration: BucketARN: !Join - '' - - 'arn:aws:s3:::' - !Ref TestBucket BufferingHints: IntervalInSeconds: 60 SizeInMBs: 1 CompressionFormat: UNCOMPRESSED Prefix: firehose/ RoleARN: !GetAtt TestDeliveryRole.Arn TestDeliveryRole: Type: AWS::IAM::Role Properties: AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Sid: '' Effect: Allow Principal: Service: firehose.amazonaws.com Action: 'sts:AssumeRole' Condition: StringEquals: 'sts:ExternalId': !Ref 'AWS::AccountId' TestDeliveryPolicy: Type: AWS::IAM::Policy Properties: PolicyName: firehose_delivery_policy PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 's3:AbortMultipartUpload' - 's3:GetBucketLocation' - 's3:GetObject' - 's3:ListBucket' - 's3:ListBucketMultipartUploads' - 's3:PutObject' Resource: - !Join - '' - - 'arn:aws:s3:::' - !Ref TestBucket - !Join - '' - - 'arn:aws:s3:::' - !Ref TestBucket - '*' Roles: - !Ref TestDeliveryRole

そのうち SAM 側でうまく吸収してもうちょっと単純にかけるようになるのではないかなと思います。

Copyright © 53ningen.com