amazon-web-services - 部署 CloudFormation 模板导致错误

Question

我想使用 AWS CLI 从 GitLab 管道测试 ECS 堆栈的部署。

我的测试项目的核心是 Docker Compose Flask app 的变体.

文件app.py:

import time

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello():
    return 'Hello World!'

及其requirements.txt:

flask

Dockerfile 是:

FROM python:3.7-alpine
WORKDIR /code
ENV FLASK_APP=app.py
ENV FLASK_RUN_HOST=0.0.0.0
RUN apk add --no-cache gcc musl-dev linux-headers
COPY requirements.txt requirements.txt
RUN pip install -r requirements.txt
EXPOSE 5000
COPY . .
CMD ["flask", "run"]

Docker Compose 文件是:

version: "3.9"
services:
  web:
    image: registry.gitlab.com/<MYNAME>/<MYPROJECT>
    x-aws-pull_credentials: "<CREDENTIALS>"
    ports:
      - "5000:5000"

我使用 ECS Docker Context 生成 CloudFormationTemplate.yml 文件(使用 ecs Docker 上下文 myecscontext，而不是默认)和命令

docker compose convert > CloudFormationTemplate.yml

当我尝试从本地工作站 (Win10) 在 AWS 上部署时:

aws cloudformation deploy --template-file CloudFormationTemplate.yml --stack-name test-stack

我收到错误

unacceptable character #x0000: special characters are not allowed
  in "<unicode string>", position 3

怎么了？谢谢。

==========

已添加

这里是CloudFormationTemplate.yml:

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CloudMap:
    Properties:
      Description: Service Map for Docker Compose project cloudformation
      Name: cloudformation.local
      Vpc: vpc-XXXXXXXX
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
  Cluster:
    Properties:
      ClusterName: cloudformation
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
    Type: AWS::ECS::Cluster
  Default5000Ingress:
    Properties:
      CidrIp: 0.0.0.0/0
      Description: web:5000/tcp on default network
      FromPort: 5000
      GroupId:
        Ref: DefaultNetwork
      IpProtocol: TCP
      ToPort: 5000
    Type: AWS::EC2::SecurityGroupIngress
  DefaultNetwork:
    Properties:
      GroupDescription: cloudformation Security Group for default network
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.network
        Value: default
      VpcId: vpc-XXXXXXXX
    Type: AWS::EC2::SecurityGroup
  DefaultNetworkIngress:
    Properties:
      Description: Allow communication within network default
      GroupId:
        Ref: DefaultNetwork
      IpProtocol: "-1"
      SourceSecurityGroupId:
        Ref: DefaultNetwork
    Type: AWS::EC2::SecurityGroupIngress
  LoadBalancer:
    Properties:
      LoadBalancerAttributes:
      - Key: load_balancing.cross_zone.enabled
        Value: "true"
      Scheme: internet-facing
      Subnets:
      - subnet-XXXXXXXX
      - subnet-XXXXXXXX
      - subnet-XXXXXXXX
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      Type: network
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  LogGroup:
    Properties:
      LogGroupName: /docker-compose/cloudformation
    Type: AWS::Logs::LogGroup
  WebService:
    DependsOn:
    - WebTCP5000Listener
    Properties:
      Cluster:
        Fn::GetAtt:
        - Cluster
        - Arn
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      LaunchType: FARGATE
      LoadBalancers:
      - ContainerName: web
        ContainerPort: 5000
        TargetGroupArn:
          Ref: WebTCP5000TargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
          - Ref: DefaultNetwork
          Subnets:
          - subnet-XXXXXXXX
          - subnet-XXXXXXXX
          - subnet-XXXXXXXX
      PlatformVersion: 1.4.0
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
      - RegistryArn:
          Fn::GetAtt:
          - WebServiceDiscoveryEntry
          - Arn
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.service
        Value: web
      TaskDefinition:
        Ref: WebTaskDefinition
    Type: AWS::ECS::Service
  WebServiceDiscoveryEntry:
    Properties:
      Description: '"web" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
        - TTL: 60
          Type: A
        RoutingPolicy: MULTIVALUE
      HealthCheckCustomConfig:
        FailureThreshold: 1
      Name: web
      NamespaceId:
        Ref: CloudMap
    Type: AWS::ServiceDiscovery::Service
  WebTCP5000Listener:
    Properties:
      DefaultActions:
      - ForwardConfig:
          TargetGroups:
          - TargetGroupArn:
              Ref: WebTCP5000TargetGroup
        Type: forward
      LoadBalancerArn:
        Ref: LoadBalancer
      Port: 5000
      Protocol: TCP
    Type: AWS::ElasticLoadBalancingV2::Listener
  WebTCP5000TargetGroup:
    Properties:
      Port: 5000
      Protocol: TCP
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      TargetType: ip
      VpcId: vpc-XXXXXXXX
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
  WebTaskDefinition:
    Properties:
      ContainerDefinitions:
      - Command:
        - XXXXXXXX.compute.internal
        - cloudformation.local
        Essential: false
        Image: docker/ecs-searchdomain-sidecar:1.0
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group:
              Ref: LogGroup
            awslogs-region:
              Ref: AWS::Region
            awslogs-stream-prefix: cloudformation
        Name: Web_ResolvConf_InitContainer
      - DependsOn:
        - Condition: SUCCESS
          ContainerName: Web_ResolvConf_InitContainer
        Essential: true
        Image: registry.gitlab.com/MYUSER/cloudformation
        LinuxParameters: {}
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group:
              Ref: LogGroup
            awslogs-region:
              Ref: AWS::Region
            awslogs-stream-prefix: cloudformation
        Name: web
        PortMappings:
        - ContainerPort: 5000
          HostPort: 5000
          Protocol: tcp
        RepositoryCredentials:
          CredentialsParameter: arn:aws:secretsmanager:XXXXXXXXXXXXXXXXXXXXXXXX
      Cpu: "256"
      ExecutionRoleArn:
        Ref: WebTaskExecutionRole
      Family: cloudformation-web
      Memory: "512"
      NetworkMode: awsvpc
      RequiresCompatibilities:
      - FARGATE
    Type: AWS::ECS::TaskDefinition
  WebTaskExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Condition: {}
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - secretsmanager:GetSecretValue
            - ssm:GetParameters
            - kms:Decrypt
            Condition: {}
            Effect: Allow
            Principal: {}
            Resource:
            - arn:aws:secretsmanager:XXXXXXXXXXXXXXXXXXXXXXXX
        PolicyName: webGrantAccessToSecrets
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.service
        Value: web
    Type: AWS::IAM::Role

Answer 1

docker compose Convert 不会在默认上下文中创建有效的 CloudFormation (CFN) 模板。在尝试生成它之前，您必须创建 ECS 上下文:

docker context create ecs myecscontext

然后您必须从 default 上下文切换到 myecscontext:

docker context use myecscontext

使用docker context ls确认您处于正确的上下文中(即myecscontext)。然后你可以使用你的convert命令

docker compose convert

生成实际的 CFN 模板。