Python AWS CDK-将IAM配置文件添加到启动模板时的循环依赖关系

我正在尝试使用AWS CDK构建

LaunchTemplate

（稍后我想将其与ASG一起使用），我需要指定

iam\u实例\u概要文件

。不幸的是，当我这样做时，它会因为循环依赖而崩溃

我的第一次尝试是选择通过

add\u auto\u scaling\u group\u capacity

方法构建的角色（它使用

LaunchConfiguration

而不是

LaunchTemplate

构建ASG，因此我无法将其用于spot fleet）：

实例_

profile = nodegroup_resource.node.find_child("InstanceProfile")
launch_template = aws_ec2.CfnLaunchTemplate(
            self.cluster, "launch_template",
            launch_template_data = aws_ec2.CfnLaunchTemplate.LaunchTemplateDataProperty(
                (...)
                # circural dependency
                iam_instance_profile=instance_profile
            )
        )

这与

Error: Resolution error: Resolution error: Unable to resolve object tree with circular reference. Path: /Resources/${Token[eks-staging.Staging.launch_template.LogicalID.1848]}/Properties/launchTemplateData/iamInstanceProfile/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host/node/host..
    at resolve (/tmp/jsii-kernel-JNb7BY/node_modules/@aws-cdk/core/lib/private/resolve.js:35:15)
    at Object.resolve (/tmp/jsii-kernel-JNb7BY/node_modules/@aws-cdk/core/lib/private/resolve.js:29:33)
    at resolve (/tmp/jsii-kernel-JNb7BY/node_modules/@aws-cdk/core/lib/private/resolve.js:118:43)

因此，我尝试跳过在构造时添加配置文件，显式添加依赖项，然后添加配置文件：

launch_template = aws_ec2.CfnLaunchTemplate(
            self.cluster, "launch_template",
            launch_template_data = aws_ec2.CfnLaunchTemplate.LaunchTemplateDataProperty(
                (...)
                # circural dependency
                # iam_instance_profile=instance_profile
            )
        )
launch_template.add_depends_on(instance_profile)
launch_template.add_property_override('iam_instance_profile', instance_profile)

这也会失败，但错误稍有不同：

RangeError: Resolution error: Maximum call stack size exceeded.
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:1:1)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)
    at deepMerge (/tmp/jsii-kernel-QQgBdo/node_modules/@aws-cdk/core/lib/cfn-resource.js:409:17)

我认为首先构建

InstanceProfile

的方式可能有问题，因此我尝试构建另一个附加了相同角色的对象：

role = nodegroup_resource.node.find_child('InstanceRole')
instance_profile = aws_iam.CfnInstanceProfile(self.cluster, "instance_profile", roles=[role.role_arn])

不幸的是，它没有帮助，错误是一样的

---

我怎样才能解决它？或者至少是如何调试确切的问题？

我发现了一个TypeScript示例，可以根据您的情况对Python进行调整：基本上，您需要做的是首先创建角色，然后创建CfnInstanceRole，然后在CfnLaunchTemplate中引用ARN（而不是构造本身）。这样，三个结构之间只有单向依赖关系。是的，我首先基于这个例子。我想避免的是新角色的产生。相反，我尝试使用LaunchTemplate选择为ASG创建的角色，这样它就可以拥有完全相同的权限，而无需手动处理它们……您可以随时检查生成该角色的原始源代码并复制它。