upload-to-oss-with-server-signature.yml

ROSTemplateFormatVersion: '2015-09-01'
Description:
  zh-cn: 从服务器获取签名信息并上传数据到OSS。
  en: Obtain signature information from the server and upload data to OSS.
Parameters:
  CommonName:
    Type: String
    Default: oss-server-sign
  BucketName:
    AssociationPropertyMetadata:
      Length: 6
      Prefix: test-bucketname-
      CharacterClasses:
        - Class: lowercase
          min: 1
    Description:
      zh-cn: Bucket 名称在 OSS 范围内必须全局唯一。长度为3~63个字符。必须以小写英文字母或数字开头和结尾，可包含小写英文字母、数字和短划线（-）。
      en: Bucket names must be globally unique within the scope of OSS. The length is 3~63 characters. Must start and end with a lowercase English letter or number, and can contain lowercase English letters, numbers, and dashes (-).
    Label:
      zh-cn: 新建存储空间名称
      en: NewBucketName
    AllowedPattern: ^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$
    AssociationProperty: AutoCompleteInput
    Type: String
  ZoneId:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::ZoneId
    AssociationPropertyMetadata:
      AutoSelectFirst: true
    Label:
      en: Availability Zone
      zh-cn: 可用区
  InstanceType:
    Type: String
    AssociationProperty: ALIYUN::ECS::Instance::InstanceType
    AssociationPropertyMetadata:
      InstanceChargeType: PostPaid
      SystemDiskCategory: cloud_essd
      ZoneId: ${ZoneId}
    Label:
      en: Instance Type
      zh-cn: 实例规格
  Password:
    NoEcho: true
    Type: String
    Description:
      en: Server login password, Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 服务器登录密码，长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    Label:
      en: ECS Instance Password
      zh-cn: ECS实例密码
    ConstraintDescription:
      en: Length 8-30, must contain three(Capital letters, lowercase letters, numbers, ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ Special symbol in)
      zh-cn: 长度8-30，必须包含三项（大写字母、小写字母、数字、 ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/ 中的特殊符号）
    AssociationProperty: ALIYUN::ECS::Instance::Password
Outputs:
  Console.Bucket:
    Label:
      zh-cn: Bucket
      en: Bucket
    Description:
      zh-cn: 文件上传到的bucket控制台页面。可访问该链接查看上传情况。
      en: Bucket console page, view upload status.
    Value: 
      Fn::Sub:
        - https://oss.console.aliyun.com/bucket/oss-${Region}/${BucketName}
        - Region:
            Ref: ALIYUN::Region
          BucketName:
            Ref: BucketName
  Console.OssClientAddress:
    Label:
      en: OSS Client Address
      zh-cn: 客户端地址
    Description:
      zh-cn: 客户端地址，使用此地址可直接体验文件上传。
      en: Client address, use this address to directly experience file upload.
    Value:
      Fn::Sub: 
        - http://${ServerAddress}:3001/index.html
        - ServerAddress:
            Fn::Select:
              - 0
              - Fn::GetAtt:
                - InstanceGroup
                - PublicIps
  
Resources:
  AccessKey:
    Type: ALIYUN::RAM::AccessKey
    Properties:
      UserName:
        Ref: User
  InstanceGroup:
    Type: ALIYUN::ECS::InstanceGroup
    Properties:
      ZoneId:
        Ref: ZoneId
      VpcId:
          Ref: Vpc
      VSwitchId:
          Ref: VSwitch
      SecurityGroupId:
        Ref: SecurityGroup
      ImageId: aliyun_3_x64_20g_alibase_20240528.vhd
      InstanceName:
        Fn::Sub: ${CommonName}-ecs
      InstanceType:
        Ref: InstanceType
      SystemDiskCategory: cloud_essd
      SystemDiskSize: 40
      MaxAmount: 1
      InternetMaxBandwidthOut: 5
      Password:
        Ref: Password
  Bucket:
    Type: ALIYUN::OSS::Bucket
    Properties:
      BucketName:
        Ref: BucketName
      CORSConfiguration:
        CORSRule:
          - AllowedHeader:
              - '*'
            AllowedOrigin:
              - '*'
            AllowedMethod:
              - POST
      DeletionForce: true
  SecurityGroup:
    Type: ALIYUN::ECS::SecurityGroup
    Properties:
      VpcId:
        Ref: Vpc
      SecurityGroupIngress:
        - PortRange: 22/22
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
        - PortRange: 3001/3001
          SourceCidrIp: 0.0.0.0/0
          IpProtocol: tcp
  Role:
    Type: ALIYUN::RAM::Role
    Properties:
      RoleName:
        Fn::Sub: ram-oss-test-create-by-${ALIYUN::StackId}
      Policies:
        - PolicyName:
            Fn::Sub: policy-create-by-${ALIYUN::StackId}
          PolicyDocument:
            Version: '1'
            Statement:
              - Action:
                  - oss:PutObject
                Resource:
                  - Fn::Sub: acs:oss:*:*:${Bucket.Name}/*
                Effect: Allow
      AssumeRolePolicyDocument:
        Version: '1'
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              RAM:
                - Fn::Sub: acs:ram::${ALIYUN::TenantId}:root
  User:
    Type: ALIYUN::RAM::User
    Properties:
      UserName:
        Fn::Sub: user-create-by-${ALIYUN::StackId}
      PolicyAttachments:
        System:
          - AliyunSTSAssumeRoleAccess
  Vpc:
    Type: ALIYUN::ECS::VPC
    Properties:
      CidrBlock: 192.168.0.0/16
  VSwitch:
    Type: ALIYUN::ECS::VSwitch
    Properties:
      VpcId:
        Ref: Vpc
      CidrBlock: 192.168.0.0/24
      ZoneId:
        Ref: ZoneId
  ServerCommand:
    Type: ALIYUN::ECS::RunCommand
    Properties:
      CommandContent:
        Fn::Sub: 
        - |
          #!/bin/bash
          yum -y install unzip
          yum install -y npm
          
          wget -O server-signed-direct-upload.zip 'https://help-static-aliyun-doc.aliyuncs.com/file-manage-files/zh-CN/20240626/xfnqmy/server-signed-direct-upload.zip'
          unzip -o server-signed-direct-upload.zip
          rm -rf server-signed-direct-upload.zip
          cat > /root/server-signed-direct-upload/node-html-post-object/server/config.js << EOF
          module.exports = {
            accessKeyId: "${AccessKey.AccessKeyId}",
            accessKeySecret: "${AccessKey.AccessKeySecret}",
            region: "oss-${ALIYUN::Region}",
            bucket: "${Bucket.Name}",
            roleArn: "${Role.Arn}",
          };
          EOF
          sed -i 's/127.0.0.1/${ServerAddress}/g' /root/server-signed-direct-upload/node-html-post-object/index.html
          cd /root/server-signed-direct-upload/node-html-post-object/
          source /root/.bashrc
          npm config set registry https://registry.npmmirror.com
          npm install
          nohup node server/index.js > output.log 2>&1 &
        - ServerAddress:
            Fn::Select:
              - 0
              - Fn::GetAtt:
                - InstanceGroup
                - PublicIps
      Type: RunShellScript
      Sync: true
      InstanceIds:
        Fn::GetAtt:
          - InstanceGroup
          - InstanceIds
      Timeout: 3600
    DependsOn:
      - SecurityGroup
Metadata:
  ALIYUN::ROS::Interface:
    ParameterGroups:
      - Parameters:
          - BucketName
          - ZoneId
          - InstanceType
          - Password
    TemplateTags:
      - acs:document-help:oss:服务端签名后直传