amazon-web-services - 安全组不属于VPC

Question

我正在尝试创建一个面向互联网的 elb。我在俄亥俄州地区 (us-east-2) 创建了 vpc。我创建了4个子网。 2 个公共(public)子网和 2 个私有(private)子网。公共(public)子网:子网 A (us-east-2a)、子网 B (us-east-2b)私有(private)子网:SubnetC (us-east-2a) 、SubnetD (us-east-2b)当我将可用区提供给负载均衡器时，它显示以下错误安全组不属于 VPC

---
AWSTemplateFormatVersion: 2010-09-09
Parameters:
  SourceStackName:
    Description: "Source stack name"
    Type: String
    AllowedPattern: "^[a-zA-Z][-a-zA-Z0-9]*$"
    Default: "wahaj-vpc"
Resources:
  wahajelb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: wahaj-elb
      VpcId:
        Fn::ImportValue:
          Fn::Sub: "${SourceStackName}-VpcID"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server

  MyLoadBalancer:
    Type: AWS::ElasticLoadBalancing::LoadBalancer
    Properties:
      Listeners:
        - LoadBalancerPort: "80"
          InstancePort: "80"
          Protocol: HTTP
      SecurityGroups:
        - !Ref wahajelb
      LoadBalancerName: wahajelb
      Subnets:
        - Fn::ImportValue: !Sub "${SourceStackName}-SubnetC"
        - Fn::ImportValue: !Sub "${SourceStackName}-SubnetD"
      HealthCheck:
        Target: HTTP:80/SamplePage.php
        HealthyThreshold: "3"
        UnhealthyThreshold: "5"
        Interval: "30"
        Timeout: "5"

我是新手，所以如果需要对模板进行任何更改，请告诉我我可能犯了一些错误。专有网络模板

---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 11.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2a
      VpcId: !Ref VPC
      CidrBlock: 11.0.0.0/24
      MapPublicIpOnLaunch: true
  SubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2b
      VpcId: !Ref VPC
      CidrBlock: 11.0.1.0/24
      MapPublicIpOnLaunch: true
  SubnetC:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2a
      VpcId: !Ref VPC
      CidrBlock: 11.0.2.0/24
      MapPublicIpOnLaunch: false
  SubnetD:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2b
      VpcId: !Ref VPC
      CidrBlock: 11.0.3.0/24
      MapPublicIpOnLaunch: false
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  RouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  InternetRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      RouteTableId: !Ref RouteTable
  SubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetA
  SubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetB
  SubnetCRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable2
      SubnetId: !Ref SubnetC

  SubnetDRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable2
      SubnetId: !Ref SubnetD
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "Internet Group"
      GroupDescription: "SSH traffic in, all traffic out."
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: "22"
          ToPort: "22"
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
  NAT:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
          - EIP
          - AllocationId
      SubnetId:
        Ref: SubnetA
      Tags:
        - Key: Name
          Value: wahaj-nat
  EIP:
    DependsOn: VPCGatewayAttachment
    Type: AWS::EC2::EIP
    Properties:
      Domain: VPC
  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: RouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NAT
Outputs:
  vpcID:
    Description: VPC id
    Value: !Ref VPC
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-VpcID"
  SubnetA:
    Description: public subnet
    Value: !Ref SubnetA
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-SubnetA"
  SubnetB:
    Description: public subnet 2
    Value: !Ref SubnetB
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-SubnetB"
  SubnetC:
    Description: priavte subnet
    Value: !Ref SubnetC
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-SubnetC"
  SubnetD:
    Description: private subnet 2
    Value: !Ref SubnetD
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-SubnetD"

自动缩放模板

---
AWSTemplateFormatVersion: 2010-09-09
Parameters:
  SourceStackName:
    Description: "Source stack name"
    Type: String
    AllowedPattern: "^[a-zA-Z][-a-zA-Z0-9]*$"
    Default: "wahaj-vpc"
  elb:
    Description: "elb"
    Type: String
    AllowedPattern: "^[a-zA-Z][-a-zA-Z0-9]*$"
    Default: "wahaj-elb"
  bastion:
    Description: "bastion host"
    Type: String
    AllowedPattern: "^[a-zA-Z][-a-zA-Z0-9]*$"
    Default: "wahaj-bastion"

Resources:
  wahajwebserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: wahaj-webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId:
            Fn::ImportValue: !Sub "${bastion}-bsgId"
          Description: For traffic from Internet
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId:
            Fn::ImportValue: !Sub "${elb}-lgsg"
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId:
        Fn::ImportValue:
          Fn::Sub: "${SourceStackName}-VpcID"
  ec2instance:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      IamInstanceProfile: !Ref ListS3BucketsInstanceProfile
      KeyName: wahaj(webserver)
      SecurityGroups:
        - Ref: wahajwebserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
  myASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AvailabilityZones:
        - "us-east-2a"
        - "us-east-2b"
      AutoScalingGroupName: myASG
      LoadBalancerNames:
        - Fn::ImportValue: !Sub "${elb}-MyLoadBalancer"
      MinSize: "2"
      MaxSize: "2"
      DesiredCapacity: "2"
      HealthCheckGracePeriod: 300
      LaunchConfigurationName:
        Ref: ec2instance
      VPCZoneIdentifier:
        - Fn::ImportValue: !Sub "${SourceStackName}-SubnetC"
        - Fn::ImportValue: !Sub "${SourceStackName}-SubnetD"
Outputs:
  Autoscaling:
    Description: autoscaling
    Value: !Ref myASG
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-myASG"
  ec2instance:
    Description: ec2instances
    Value: !Ref ec2instance
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-ec2instance"
  sg:
    Description: ec2instances securitygroup
    Value: !GetAtt wahajwebserver.GroupId
    Export:
      Name:
        Fn::Sub: "${AWS::StackName}-sg"

Answer 1

这是因为 ELB 和安全组驻留在不同的 VPC 中。

您的模板已注释掉子网，这会导致在该区域的默认 VPC 中创建负载均衡器，但您的安全组显式设置了 VPC ID。因此它们位于不同的 VPC 中。

确保您定义支持它的资源的 VPC ID/子网 ID 始终是良好做法，对于某些没有此属性的资源(例如 EC2)，当您进行更改时它们将始终被替换(例如更改标签)通过 CloudFormation。