aws-cloudformation - ECS 服务使用 ALB 的权限问题

Question

我尝试使用 cloudformation 部署带有 ALB 的 ECS 堆栈，但在创建服务时出现错误，这似乎缺少访问负载均衡器的权限。

错误如下:无法承担角色并验证指定的 targetGroupArn。请验证正在传递的ECS服务角色是否具有适当的权限。

这是服务定义:

    "EcsService": {
      "Type":"AWS::ECS::Service",
      "DependsOn": [
        "loadBalancer",
        "EcsServiceRole"
      ],
      "Properties":{
        "Cluster":{
          "Ref": "EcsCluster"
        },
        "DesiredCount":"1",
        "DeploymentConfiguration":{
          "MaximumPercent":100,
          "MinimumHealthyPercent":0
        },
        "LoadBalancers": [
          {
            "ContainerName": "test-web",
            "ContainerPort": "80",
            "TargetGroupArn" : {
              "Ref": "loadBalancer"
            },
          }
        ],
        "Role":{
          "Ref": "EcsServiceRole"
        },
        "TaskDefinition":{
          "Ref": "runWebServerTaskDefinition"
        }
      }
    }

这是负载均衡器的定义:

    "loadBalancer" : {
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
      "Properties": {
        "Name": "testalb",
        "Scheme" : "internal",
        "Subnets" : [
          "subnet-b8217295",
          "subnet-ddaad2b8",
          "subnet-6d71fb51"
        ],
        "LoadBalancerAttributes" : [
          { "Key" : "idle_timeout.timeout_seconds", "Value" : "50" }
        ],
        "SecurityGroups": [
          { "Ref": "InstanceSecurityGroupOpenWeb" },
          { "Ref" : "InstanceSecurityGroupOpenFull" }
        ],
        "Tags" : [
          { "Key" : "key", "Value" : "value" },
          { "Key" : "key2", "Value" : "value2" }
        ]
      }
    }

以下是服务应使用的 IAM 角色:

    "EcsServiceRole": {
      "Type":"AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement":[
            {
              "Effect":"Allow",
              "Principal":{
                "Service":[
                  "ecs.amazonaws.com"
                ]
              },
              "Action":[
                "sts:AssumeRole"
              ]
            }
          ]
        },
        "Path":"/",
        "Policies":[
          {
            "PolicyName":"ecs-service",
            "PolicyDocument":{
              "Statement":[
                {
                  "Effect":"Allow",
                  "Action":[
                    "elasticloadbalancing:*",
                    "ec2:*"
                  ],
                  "Resource":"*"
                }
              ]
            }
          }
        ]
      }
    }

我没有找到IAM中是否有针对ALB的特定命名空间。你有什么想法吗？

Answer 1

TargetGroupArn 应该指向 TargetGroup ARN，而不是 ALB ARN，目前，它指向负载均衡器 ARN。

          "TargetGroupArn" : {
              "Ref": "loadBalancer"
            },