使用Step Functions运行AWS Backup时必备的权限要点

引言

在尝试从Step Functions执行AWS Backup的按需备份时，我在权限方面遇到了一些困难。为了备忘，我将这些经验写成这篇文章。

概述

从Step Functions执行AWS Backup时，需要分配以下权限：

AWS Backup相关权限

• 执行备份的权限

Step Functions相关权限

• 将上述角色传递给其他服务的权限
• 对保存目标的BackupVault执行StartBackupJob的权限

下面将包含一个使用Step Functions执行按需备份的CloudFormation代码示例。

参考

AWS Backup 和 AWS CloudFormation

CloudFormation代码

作为最简单的构成，我们将创建以下资源：

1. BackupVault
2. 备份用Role
3. Step Functions用Role
4. 执行按需备份的StateMachine

以下是CloudFormation代码，在执行时需要指定目标EC2实例的ARN作为参数。

AWSTemplateFormatVersion: "2010-09-09"Parameters:Ec2Arn:Type: StringDefault: tokyo-endpointResources:MyBackupVault:Type: AWS::Backup::BackupVaultProperties:BackupVaultName: 'for-stepfunctions'MyBackupRole:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: "2012-10-17"Statement:- Effect: AllowPrincipal:Service:- backup.amazonaws.comAction:- 'sts:AssumeRole'Path: /ManagedPolicyArns:- arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup# - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestoresSMRole: Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: "2012-10-17"Statement:- Effect: AllowPrincipal:Service:- states.amazonaws.comAction:- 'sts:AssumeRole'Path: /Policies:# - PolicyName: allowSsm#   PolicyDocument:#     Version: "2012-10-17"#     Statement:#       - Effect: Allow#         Action:#           - ssm:SendCommand#         Resource: '*'- PolicyName: allowBackupJobPolicyDocument:Version: "2012-10-17"Statement:- Effect: AllowAction:- backup:StartBackupJobResource: # - !Sub arn:aws:backup:${AWS::Region}:${AWS::AccountId}:backup-vault:*- !GetAtt MyBackupVault.BackupVaultArn- Effect: AllowAction:- iam:PassRoleResource: - !GetAtt MyBackupRole.ArnexecuteEc2BackupStateMachine:Type: AWS::StepFunctions::StateMachineProperties:RoleArn: !GetAtt SMRole.ArnDefinition:StartAt: StartBackupJobStates: StartBackupJob: Type: TaskResource: arn:aws:states:::aws-sdk:backup:startBackupJobParameters: BackupVaultName: !Ref MyBackupVaultIamRoleArn: !GetAtt MyBackupRole.ArnResourceArn: !Ref Ec2ArnEnd: true

以下是将要创建的StateMachine的示例。

 由于包含了一些额外的注释，因此我们将对每个资源进行简要说明。

备份用角色

  MyBackupRole:Type: AWS::IAM::RoleProperties:AssumeRolePolicyDocument:Version: "2012-10-17"Statement:- Effect: AllowPrincipal:Service:- backup.amazonaws.comAction:- 'sts:AssumeRole'Path: /ManagedPolicyArns:- arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForBackup# - arn:aws:iam::aws:policy/service-role/AWSBackupServiceRolePolicyForRestores

• 以下内容在allowBackupJob中解决
  •  发送先前创建的备份角色的权限
  • StartBackupJob对BackupVault的权限，在代码开头创建
    • 如果您想将其用于任何 BackupVault，请使用注释掉的那个。
• 注释掉的allowSsm是允许Systems Manager的SendCommand
  • 我假设您想“在备份之前和之后运行脚本来停止/启动服务”

 状态

Step Functions 中定义的用于执行按需备份的单一状态如下。

        States: StartBackupJob: Type: TaskResource: arn:aws:states:::aws-sdk:backup:startBackupJobParameters: BackupVaultName: !Ref MyBackupVaultIamRoleArn: !GetAtt MyBackupRole.ArnResourceArn: !Ref Ec2ArnEnd: true

backup:startBackupJob的参数如下。

https://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartBackupJob.htmlhttps://docs.aws.amazon.com/aws-backup/latest/devguide/API_StartBackupJob.html

结语

这次我们以从Step Functions使用AWS Backup为例，讨论了相关的权限问题。AWS Backup也可以通过其调度功能进行备份，但如果需要在备份前后进行其他处理，可以参考本文使用Step Functions的方法。希望这篇文章能对您有所帮助。