Service Broker 在 AWS 中国区的落地

# git clone https://github.com/awslabs/aws-servicebroker.git

# cd setup

# vi prerequisites.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  Creates the prerequisites for the AWS Service Broker -
  https://github.com/awslabs/aws-servicebroker/blob/master/docs/install_prereqs.md
Resources:
  BrokerTable:
    Type: "AWS::DynamoDB::Table"
    Properties:
      AttributeDefinitions:
      - AttributeName: id
        AttributeType: S
      - AttributeName: userid
        AttributeType: S
      - AttributeName: type
        AttributeType: S
      KeySchema:
      - AttributeName: id
        KeyType: HASH
      - AttributeName: userid
        KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: 5
        WriteCapacityUnits: 5
      TableName: "awssb"
      GlobalSecondaryIndexes:
      - IndexName: "type-userid-index"
        KeySchema:
        - AttributeName: type
          KeyType: HASH
        - AttributeName: userid
          KeyType: RANGE
        Projection:
          ProjectionType: INCLUDE
          NonKeyAttributes: [ id, userid, type, locked ]
        ProvisionedThroughput:
          ReadCapacityUnits: 5
          WriteCapacityUnits: 5
  BrokerUser:
    Type: "AWS::IAM::User"
    Properties:
      Policies:
      - PolicyName: AwsServiceBrokerPolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Action: [ "s3:GetObject", "s3:ListBucket" ]
            Resource: [ "arn:aws-cn:s3:::myawsservicebroker/templates/*", "arn:aws-cn:s3:::myawsservicebroker" ]
            Effect: "Allow"
          - Action: [ "dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:DeleteItem" ]
            Resource: !Sub "arn:aws-cn:dynamodb:${AWS::Region}:${AWS::AccountId}:table/${BrokerTable}"
            Effect: "Allow"
          - Action: [ "ssm:GetParameter", "ssm:GetParameters" ]
            Resource:
            - !Sub "arn:aws-cn:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
            - !Sub "arn:aws-cn:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
            Effect: "Allow"
      - PolicyName: AwsServiceBrokerProvisioningPolicy
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
          - Action: [ "ssm:PutParameter", "ssm:GetParameter", "ssm:GetParameters" ]
            Resource:
            - !Sub "arn:aws-cn:ssm:${AWS::Region}:${AWS::AccountId}:parameter/asb-*"
            - !Sub "arn:aws-cn:ssm:${AWS::Region}:${AWS::AccountId}:parameter/Asb*"
            Effect: "Allow"
          - Action: "s3:GetObject"
            Resource: "arn:aws-cn:s3:::myawsservicebroker/templates/*"
            Effect: "Allow"
          - Action:
            - "cloudformation:CreateStack"
            - "cloudformation:DeleteStack"
            - "cloudformation:DescribeStacks"
            - "cloudformation:DescribeStackEvents"
            - "cloudformation:UpdateStack"
            - "cloudformation:CancelUpdateStack"
            Resource: !Sub "arn:aws-cn:cloudformation:${AWS::Region}:${AWS::AccountId}:stack/aws-service-broker-*/*"
            Effect: "Allow"
          - Action: [ "athena:*", "dynamodb:*", "kms:*", "elasticache:*", "elasticmapreduce:*", "kinesis:*", "rds:*",
                      "redshift:*", "route53:*", "s3:*", "sns:*", "sns:*", "sqs:*", "ec2:*", "iam:*", "lambda:*" ]
            Resource: "*"
            Effect: "Allow"
Outputs:
  IAMUser:
    Value: !Ref BrokerUser

# export AWS_ACCESS_KEY_ID=xxxxx

# export AWS_SECRET_ACCESS_KEY=xxxxxxx

# export AWS_DEFAULT_REGION=us-east-2

# mkdir awsservicebroker

# aws s3 sync s3://awsservicebroker ./awsservicebroker

# export AWS_DEFAULT_REGION=cn-northwest-1

#  export AWS_ACCESS_KEY_ID=xxxxxx

#  export AWS_SECRET_ACCESS_KEY=xxxxx

# cd awsservicebroker

# aws s3 sync ./ s3://myawsservicebroker/

# cd /usr/share/ansible/openshift-ansible/

# ansible-playbook -vv playbooks/openshift-service-catalog/config.yml

# mkdir awssb

# cd awssb

# wget https://raw.githubusercontent.com/awslabs/aws-servicebroker/release-v1.0.1/packaging/openshift/deploy.sh

# wget https://raw.githubusercontent.com/awslabs/aws-servicebroker/release-v1.0.1/packaging/openshift/aws-servicebroker.yaml

# wget https://raw.githubusercontent.com/awslabs/aws-servicebroker/release-v1.0.1/packaging/openshift/parameters.env

# chmod +x deploy.sh

# vi parameters.env

TARGETACCOUNTID=xxx

TARGETROLENAME=xxx

VPCID=vpc-xxx

REGION=cn-northwest-1

IMAGE=awsservicebroker/aws-servicebroker:1.0.1

IMAGEPULLPOLICY=IfNotPresent

S3BUCKET=myawsservicebroker

S3KEY=templates/latest

S3REGION=cn-northwest-1

TABLENAME=awssb

VERBOSITY=10

BROKERID=awsservicebroker

PRESCRIBE_OVERRIDES=true

# ./deploy.sh

# oc project aws-sb

# oc get pods | grep aws-servicebroker

# oc logs <aws-servicebroker-pod-name>

# cat s3-main.yaml

AWSTemplateFormatVersion: 2010-09-09
Description: 'AWS Service Broker - Amazon S3 (qs-1nt0fs937)'
Metadata:
  'AWS::ServiceBroker::Specification':
    Version: 1.0
    Tags:
      - AWS
      - S3
      - Object Storage
    Name: s3
    DisplayName: Amazon S3
    LongDescription: Amazon Simple Storage Service (Amazon S3) is storage for the
      Internet. You can use Amazon S3 to store and retrieve any amount of data at
      any time, from anywhere on the web. You can accomplish these tasks using the
      simple and intuitive web interface of the AWS Management Console.
    ImageUrl: https://s3.amazonaws.com/thp-aws-icons-dev/Storage_AmazonS3_LARGE.png
    DocumentationUrl: https://aws.amazon.com/documentation/s3/'
    ProviderDisplayName: "Amazon Web Services"
    Bindings:
      IAM:
        AddKeypair: True
        Policies:
          - PolicyDocument: {
            "Version": "2012-10-17",
            "Statement": [
            {
              "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteObject",
                "s3:GetObject",
                "s3:GetObjectAcl",
                "s3:GetObjectTagging",
                "s3:GetObjectTorrent",
                "s3:GetObjectVersion",
                "s3:GetObjectVersionAcl",
                "s3:GetObjectVersionTagging",
                "s3:GetObjectVersionTorrent",
                "s3:ListBucketMultipartUploads",
                "s3:ListMultipartUploadParts",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectTagging"
              ],
              "Effect": "Allow",
              "Resource": !If [ RetainBucket, !Sub "${S3BucketRetain.Arn}/*", !Sub "${S3BucketDelete.Arn}/*" ]
            },
            {
              "Action": [
                "s3:ListBucket"
              ],
              "Resource": !If [ RetainBucket, !GetAtt S3BucketRetain.Arn, !GetAtt S3BucketDelete.Arn ],
              "Effect": "Allow"
            }
            ]
          }
    ServicePlans:
      production:
        DisplayName: "Production"
        Description: 'S3 Bucket pre-configured with production best practices'
        LongDescription: "Amazon Simple Storage Service (Amazon S3) is storage for the Internet. You can use Amazon S3 to store and retrieve any amount of data at any time, from anywhere on the web. You can accomplish these tasks using the simple and intuitive web interface of the AWS Management Console."
        Cost: "https://aws.amazon.com/s3/pricing/"
        ParameterValues:
          BucketName: "Auto"
          LoggingPrefix: S3AccessLogs
          # TODO: add glacier lifecycle for previous versions
          EnableGlacierLifeCycle: "False"
          GlacierLifeCycleTransitionInDays: "30"
          LifeCyclePrefix: Archive
          EnableVersioning: "True"
          BucketAccessControl: Private
          EnableLogging: "True"
          PreventDeletion: "True"
      custom:
        DisplayName: "Custom"
        Description: 'S3 Bucket pre-configured with custom configuration'
        LongDescription: "Amazon Simple Storage Service (Amazon S3) is storage for the Internet. You can use Amazon S3 to store and retrieve any amount of data at any time, from anywhere on the web. You can accomplish these tasks using the simple and intuitive web interface of the AWS Management Console."
        Cost: "https://aws.amazon.com/s3/pricing/"
  'AWS::CloudFormation::Interface':
    ParameterGroups:
  ……CloudFormation模版的内容 ……