amazon-web-services - AWS CloudFormation Internet 网关错误

Question

这里是CloudFormation初学者。我一直在研究和开发 CloudFormation 模板，该模板最终将用作我的团队开发环境的起点。

我一直在网上挑选一些类(class)和示例，并且在我的小尝试中取得了相对成功......直到今晚。

我现在尝试将 Internet 网关附加到我的 VPC，这导致堆栈创建作业失败并回滚。互联网网关无法连接，我一生都无法确定原因。

我的完整模板在这里。该计划是创建一个具有 2 个公共(public)子网和 2 个私有(private)子网的 VPC。将有一个 Internet 网关连接到 2 个公共(public)子网。这就是失败的根源。如果我注释掉 Internet 网关的创建，则模板成功。预先感谢您的帮助。

AWSTemplateFormatVersion: '2010-09-09'

Resources:
  DevVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      InstanceTenancy: default
  Tags:
  - Key: Name
    Value: dev-vpc

  DevRoute53HostedZone:
    Type: "AWS::Route53::HostedZone"
    Properties:
      HostedZoneConfig:
        Comment: "aws hosted dev environment"
      Name: "mydomain.oregon-dev.local"
      VPCs:
        -
          VPCId: !Ref DevVPC
          VPCRegion: "us-west-2"

  DevPublicSubnetA:
Type: AWS::EC2::Subnet
Properties:
  VpcId: !Ref DevVPC
  CidrBlock: 10.0.8.0/25
  AvailabilityZone: "us-west-2a"
  Tags:
  - Key: Name
    Value: DevPublicSubnetA

  DevPublicSubnetB:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref DevVPC
        CidrBlock: 10.0.8.128/25
        AvailabilityZone: "us-west-2b"
        Tags:
        - Key: Name
          Value: DevPublicSubnetB

  DevPrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.9.0/25
      AvailabilityZone: "us-west-2a"
      Tags:
      - Key: Name
        Value: DevPrivateSubnetA

  DevPrivateSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref DevVPC
      CidrBlock: 10.0.9.128/25
      AvailabilityZone: "us-west-2b"
      Tags:
      - Key: Name
        Value: DevPrivateSubnetB

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: DevVPC
      Tags:
      - Key: Name
        Value: DevRouteTable

  DevRoute:
    Type: AWS::EC2::Route
    DependsOn: NonProdNATGateway
    Properties:
      RouteTableId:
        Ref: RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: NonProdNATGateway

  NonProdNATEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NonProdNATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NonProdNATEIP.AllocationId
      SubnetId: !Ref DevPublicSubnetA
      SubnetId: !Ref DevPublicSubnetB
    DependsOn:
      - NonProdNATEIP
      - DevPublicSubnetA
      - DevPublicSubnetB

  NonProdGWVPCAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref NonProdNATGateway
      VpcId: !Ref DevVPC
    DependsOn:
      - NonProdNATGateway

  Route:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: NonProdNATGateway

  PrivateRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref DevPrivateSubnetA
      SubnetId: !Ref DevPrivateSubnetB

  PublicRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref DevPublicSubnetA
      SubnetId: !Ref DevPublicSubnetB

Mappings:
  R53EnvironmentMapping:
    dev:
      oregonawslocal: mydomain.oregon-dev.local

Outputs:

  DevPublicSubnetA:
    Description: ID for dev subnet A
    Value: !Ref DevPublicSubnetA
    Export:
      Name: DevPublicSubnetA

  DevPublicSubnetB:
    Description: ID for dev subnet B
    Value: !Ref DevPublicSubnetB
    Export:
      Name: DevPublicSubnetB

  DevPrivateSubnetA:
    Description: ID for dev subnet A
    Value: !Ref DevPrivateSubnetA
    Export:
       Name: DevPrivateSubnetA

  DevPrivateSubnetB:
    Description: ID for dev subnet B
    Value: !Ref DevPrivateSubnetB
    Export:
      Name: DevPrivateSubnetB

   DevRoute53OregonAWSLocalHostedZone:
    Description: Hosted zone ID for hosted zone
    Value: !Ref DevRoute53HostedZone
    Export:
      Name: DevRoute53OregonAWSLocalHostedZone

  DevRoute53OregonAWSLocalHostedZoneName:
    Description: Hosted zone name for hosted zone
     Value: !FindInMap [R53EnvironmentMapping, dev, oregonawslocal]
     Export:
       Name: DevRoute53OregonAWSLocalHostedZoneName

Answer 1

如Michael - sqlbot comment中提到，一个问题是您引用的是 AWS::EC2::NATGateway资源在 AWS::EC2::VPCGatewayAttachment资源的InternetGatewayId属性，这需要 AWS::EC2::InternetGateway资源。

NAT Gateways和 Internet Gateways是两种不同类型的 AWS 资源 - NAT 网关提供对私有(private)子网的仅出站 Internet 访问，而 Internet 网关提供对公共(public)子网的双向 Internet 访问。

另一个问题是您需要两组单独的 AWS::EC2::RouteTable和 AWS::EC2::Route资源，一组用于您的公共(public)子网，另一组用于您的私有(private)子网。公共(public)路线应该有 GatewayId引用互联网网关，并且私有(private)路由应该有 NatGatewayId引用 NAT 网关。

最后，您在多个资源(NatGateway、SubnetRouteTableAssociation)中存在一些无效的重复 SubnetId 属性 - 每个资源仅接受一个点单个子网 ID。

由于您是 CloudFormation 初学者，我强烈建议您利用 AWS Quick Start的Amazon VPC Architecture template快速开始使用引用 VPC 架构。此 AWS 支持的模板创建一个 VPC，其中包含每个指定可用区中的公有子网和私有(private)子网(您提供 2-4 个可用区作为参数)。您稍后可以根据需要自定义此模板以更好地满足您的特定需求，或者将其用作配置您自己的模板资源的引用。