amazon-ec2 - 在特定子网和安全组cloudformation中创建实例

Question

我正在尝试使用 cfn 模板启动实例。该实例需要在特定的现有子网以及模板中创建的安全组中启动。

我有以下参数来获取包含子网的列表:

"Subnet": {
  "Description": "Subnet to put Instance",
  "Type": "AWS::EC2::Subnet::Id",
},

我有以下资源来创建安全组:

"InstanceSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupDescription": "Enables access to instance by port 80",
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": "80",
            "ToPort": "80",
            "CidrIp": {
              "Ref": "ClientCIDR"
            }
          }
        ]
      },

我有以下资源来创建实例:

"WebServer": {
  "Type": "AWS::EC2::Instance",
  "Properties": {
    "IamInstanceProfile": "access-profile",
    "SecurityGroupIds": [
      { "Fn::GetAtt": [
          "InstanceSecurityGroup",
          "GroupId"
        ]
      }
    ],
    "SubnetId": {
      "Ref": "Subnet"
    },

当我尝试创建实例并选择现有子网时，出现以下错误:

Security group sg-**** and subnet subnet-**** belong to different networks. 

请帮忙解决这个问题..

Answer 1

AWS::EC2::Subnet您正在添加到 AWS::EC2::Instance处于不同的 AWS::EC2::VPC到AWS::EC2::SecurityGroup 。

创建 InstanceSecurityGroup 资源时，您应该使用 AWS::EC2::SecurityGroup VpcId 属性来创建 AWS::EC2::SecurityGroup特别是AWS::EC2::VPC 。该属性的文档说明

VpcId

The physical ID of the VPC. Can be obtained by using a reference to an AWS::EC2::VPC, such as: { "Ref" : "myVPC" }.

For more information about using the Ref function, see Ref.

Required: Yes, for VPC security groups

您的账户使用 EC2-VPC，如果您使用 ec2-classic，则只能省略 VpcId 参数，here are the differences介于 ec2-classic 和 ec2-vpc 之间。

Cloud Formation 模板可以接受 AWS 特定 Parameter输入 AWS::EC2::VPC::Id 例如

"VPCId": {
    "Type":  "AWS::EC2::VPC::Id"
    "Description": "The VPC Id to where this instance is being created"
}

还有这个Parameter然后可以使用内在的 Ref function引用 AWS::EC2::SecurityGroup 中的 VPCId 参数

"InstanceSecurityGroup": {
    "Type": "AWS::EC2::SecurityGroup",
    "Properties": {
        "GroupDescription": "Enables access to instance by port 80",
        "VPCId": {
            "Ref": "VPCId"
        },
        "SecurityGroupIngress": [
            {
                "IpProtocol": "tcp",
                "FromPort": "80",
                "ToPort": "80",
                "CidrIp": {
                    "Ref": "ClientCIDR"
                }
            }
        ]
    }
}