amazon-web-services - CloudFormation - 一起使用条件、伪参数和内部函数来定义单个资源属性

Question

我有一个定义了两个条件的 CloudFormation 模板。如果我们在 us-west-2(支持网络 ELB IS)中启动堆栈，则它将 CreateNetworkLoadBalancer 设置为 True。如果我们在 sa-east-1(圣保罗，仅支持经典 ELB)运行此堆栈，则 CreateNetworkLoadBalancer 设置为 False，并且 CreateClassicLoadBalancer 为 True。 (示例如下)

Conditions:
  CreateClassicLoadBalancer: !Equals [ !Ref "AWS::Region", sa-east-1 ]
  CreateNetworkLoadBalancer: !Equals [ !Ref "AWS::Region", us-west-2 ]

堆栈随后定义了两个资源，一个网络和一个经典 ELB，如下所示。它根据区域和条件仅启动适当的负载均衡。这一切都按预期进行。 (示例如下)

Resources:
  ######################################################
  # Network Load Balancer, Target Group, etc.
  # NLB
  NLB:
    Type: "AWS::ElasticLoadBalancingV2::LoadBalancer"
    Condition: CreateNetworkLoadBalancer
    Properties:
      LoadBalancerAttributes:
        - Key: deletion_protection.enabled
          Value: False
      Name: !Join [ "-", [ !Ref awsTagsNamePrefix, "nlb" ] ]
      Scheme: internet-facing
      Subnets: !Ref bastionSubnetList
      Tags:
      - Key: Environment
        Value: !Ref awsTagsEnvironment
      - Key: Application
        Value: !Ref awsTagsApplication
      - Key: Name
        Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "nlb" ] ]
      Type: network
      IpAddressType: ipv4
  # target group
  NLBTargetGroup:
    Type: "AWS::ElasticLoadBalancingV2::TargetGroup"
    Condition: CreateNetworkLoadBalancer
    Properties:
      HealthCheckIntervalSeconds: 30
      HealthCheckPort: 22
      HealthCheckProtocol: TCP
      HealthCheckTimeoutSeconds: 10
      HealthyThresholdCount: 3
      Name: !Join [ "-", [ !Ref awsTagsNamePrefix, "elb-target-group" ] ]
      Port: 22
      Protocol: TCP
      Tags:
      - Key: Environment
        Value: !Ref awsTagsEnvironment
      - Key: Application
        Value: !Ref awsTagsApplication
      - Key: Name
        Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "elb-target-group" ] ]
      TargetGroupAttributes:
        - Key: deregistration_delay.timeout_seconds
          Value: 0
      UnhealthyThresholdCount: 3
      VpcId: !Select [0, !Ref vpcIdList]
  # Listener
  NLBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Condition: CreateNetworkLoadBalancer
    Properties:
      DefaultActions:
      - TargetGroupArn: !Ref NLBTargetGroup
        Type: forward
      LoadBalancerArn: !Ref NLB
      Port: 22
      Protocol: TCP
  ######################################################


  ######################################################
  # Classic ELB - for regions that do not yet support a Network LB.
  # ELB
  ELB:
    Type: "AWS::ElasticLoadBalancing::LoadBalancer"
    Condition: CreateClassicLoadBalancer
    Properties:
      Subnets: !Ref bastionSubnetList
      HealthCheck:
        HealthyThreshold: '3'
        Interval: '10'
        Target: TCP:22
        Timeout: '5'
        UnhealthyThreshold: '3'
      ConnectionSettings:
        IdleTimeout: '60'
      CrossZone: 'true'
      SecurityGroups:
      - Ref: BastionELBSG
      Listeners:
      - InstancePort: '22'
        LoadBalancerPort: '22'
        Protocol: TCP
        InstanceProtocol: TCP
      LoadBalancerName: !Join [ "-", [ !Ref awsTagsNamePrefix, "bastion-elb" ] ]
      Tags:
      - Key: Environment
        Value: !Ref awsTagsEnvironment
      - Key: Application
        Value: !Ref awsTagsApplication
      - Key: Name
        Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "bastion-elb" ] ]

通过堆栈更新，我们现在希望添加代码以将现有负载均衡器(根据区域配置的负载均衡器)关联到 AutoScaling 组。为此，AutoScaling 为每个属性(网络 LoadBalancer 目标组的 TargetGroupARNs 和经典 ELB 的 LoadBalancerNames)提供了单独的属性。我们在 AWS::AutoScaling::AutoScalingGroup 中定义两者，并依赖于条件的 True/False 值，即内部函数 (Fn::If)，和 AWS::NoValue 伪参数。理论上，下面的代码应该可以工作。

TargetGroupARNs:
        !If
          - CreateNetworkLoadBalancer
          - !Ref NLBTargetGroup
          - !Ref "AWS::NoValue"
      LoadBalancerNames:
        !If
          - CreateClassicLoadBalancer
          - !Ref ELB
          - !Ref "AWS::NoValue"

但是，Yaml 的语法/格式不正确 - 我们在运行堆栈时收到以下错误(属性 TargetGroupARNs 的值必须是字符串列表类型)。

将 If、条件和 NoValue 绑定(bind)在一起的正确方法是什么，以便单个字符串的列表(导致 !Ref 到 NoValue 或 NLB) 是否分配给 TargetGroupARNs 的值？

BastionASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      AvailabilityZones:
        Fn::GetAZs: !Ref "AWS::Region"
      Cooldown: '0'
      DesiredCapacity: '0'
      HealthCheckGracePeriod: '60'
      HealthCheckType: EC2
      MaxSize: '0'
      MinSize: '0'
      VPCZoneIdentifier: !Ref bastionSubnetList
      LaunchConfigurationName:
        Ref: BastionLC
      Tags:
      - Key: Environment
        Value: !Ref awsTagsEnvironment
        PropagateAtLaunch: true
      - Key: Application
        Value: !Ref awsTagsApplication
        PropagateAtLaunch: true
      - Key: Name
        Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "asg-ec2" ] ]
        PropagateAtLaunch: true
      TargetGroupARNs:
        !If
          - CreateNetworkLoadBalancer
          - !Ref NLBTargetGroup
          - !Ref "AWS::NoValue"
      LoadBalancerNames:
        !If
          - CreateClassicLoadBalancer
          - !Ref ELB
          - !Ref "AWS::NoValue"
      TerminationPolicies:
      - OldestInstance

Answer 1

我认为您最好使用 conditions 创建两个 BastionASG 资源关于资源

BastionASGElb:
  Type: AWS::AutoScaling::AutoScalingGroup
  Condition: CreateClassicLoadBalancer
  Properties:
    AvailabilityZones:
      Fn::GetAZs: !Ref "AWS::Region"
    Cooldown: '0'
    DesiredCapacity: '0'
    HealthCheckGracePeriod: '60'
    HealthCheckType: EC2
    MaxSize: '0'
    MinSize: '0'
    VPCZoneIdentifier: !Ref bastionSubnetList
    LaunchConfigurationName:
      Ref: BastionLC
    Tags:
    - Key: Environment
      Value: !Ref awsTagsEnvironment
      PropagateAtLaunch: true
    - Key: Application
      Value: !Ref awsTagsApplication
      PropagateAtLaunch: true
    - Key: Name
      Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "asg-ec2" ] ]
      PropagateAtLaunch: true
    LoadBalancerNames:
      - !Ref ELB
    TerminationPolicies:
    - OldestInstance

BastionASGAlb:
  Type: AWS::AutoScaling::AutoScalingGroup
  Condition: CreateNetworkLoadBalancer
  Properties:
    AvailabilityZones:
      Fn::GetAZs: !Ref "AWS::Region"
    Cooldown: '0'
    DesiredCapacity: '0'
    HealthCheckGracePeriod: '60'
    HealthCheckType: EC2
    MaxSize: '0'
    MinSize: '0'
    VPCZoneIdentifier: !Ref bastionSubnetList
    LaunchConfigurationName:
      Ref: BastionLC
    Tags:
    - Key: Environment
      Value: !Ref awsTagsEnvironment
      PropagateAtLaunch: true
    - Key: Application
      Value: !Ref awsTagsApplication
      PropagateAtLaunch: true
    - Key: Name
      Value: !Join [ "-", [ !Ref awsTagsNamePrefix, "asg-ec2" ] ]
      PropagateAtLaunch: true
    TargetGroupARNs:  
      - !Ref NLBTargetGroup
    TerminationPolicies:
    - OldestInstance