您可以使用AWS CloudFormation来向其他AWS账户提供CloudFormation堆栈。以下是一个示例解决方案:
Resources:
MyS3Bucket:
Type: "AWS::S3::Bucket"
Properties:
BucketName: "my-bucket"
Outputs:
StackOutput:
Value: !Ref MyS3Bucket
Export:
Name: !Sub "${AWS::StackName}-MyS3Bucket"
Resources:
MyS3BucketPolicy:
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref MyS3Bucket
PolicyDocument:
Statement:
- Sid: "AllowAccess"
Effect: "Allow"
Principal:
AWS: "arn:aws:iam::123456789012:root" # 替换为目标账户的ARN
Action: "s3:GetObject"
Resource: !Sub "arn:aws:s3:::${MyS3Bucket}/*"
Resources:
ImportedStack:
Type: "AWS::CloudFormation::ImportValue"
Properties:
Name: "source-account-stack-name-MyS3Bucket"
在上面的示例中,"source-account-stack-name-MyS3Bucket"是您要导入的堆栈输出的名称。
Resources:
MyBucketAccessPolicy:
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref ImportedStack
PolicyDocument:
Statement:
- Sid: "AllowAccess"
Effect: "Allow"
Principal:
AWS: "arn:aws:iam::target-account-id:root" # 替换为目标账户的ID
Action: "s3:GetObject"
Resource: !Sub "arn:aws:s3:::${ImportedStack}/*"
上述代码中,"target-account-id"是目标账户的ID。
通过上述步骤,您可以使用AWS CloudFormation向其他AWS账户提供CloudFormation堆栈。请注意,您需要确保目标账户具有适当的权限以访问来自其他账户的堆栈资源。