amazon-web-services - 我的 ENI 是如何创建的？

Question

我有以下代码，但我看不到在哪里创建实际的 ENI “AWS::EC2::NetworkInterface”。我假设这是在“UTMLaunchConfiguration”运行后在脚本的 UserData 部分中完成的。我仍在学习，所以我确信这不是一个非常困难的配置，但我仍在学习如何阅读它。

{
    "AWSTemplateFormatVersion" : "2010-09-09",

    "Description" : "Sophos UTM HA template",

    "Mappings" : {
        "RegionMap" : {
            "us-gov-west-1"  : { "BYOL" : "ami-09f7972a", "AZ1" : "us-gov-west-1a", "AZ2" : "us-gov-west-1b", "EC2API" : "ec2.us-gov-west-1.amazonaws.com" }
        }
    },

    "Parameters" : {

        "01LicenseType": {
          "Description": "Hourly or BYOL",
          "Type" : "String",
          "Default" : "Hourly",
          "AllowedValues" : [ "Hourly", "BYOL" ]
        },
        "02InstanceType" : {
          "Description" : "Amazon EC2 instance type",
          "Type" : "String",
          "Default" : "m3.medium",
          "AllowedValues" : [ "t1.micro", "m1.small", "m3.medium", "m3.large", "m3.xlarge", "m3.2xlarge", "c3.large", "c3.xlarge", "c3.2xlarge", "c3.4xlarge", "c3.8xlarge"]
          ,
          "ConstraintDescription" : "must be a valid EC2 instance type."
        },
        "03Hostname" : {
          "Description" : "The hostname field can have a maximum of 64 characters. Hostname can only contain lower and uppercase letters, numbers, dots(.), dashes(-) and needs to begin with a letter or a number.",
          "Type" : "String",
          "MaxLength" : "64",
          "AllowedPattern" : "^[0-9A-Za-z]{1}([A-Za-z0-9.-]*)$",
          "ConstraintDescription" : "Invalid hostname. The hostname field can have a maximum of 64 characters. Hostname can only contain lower- and uppercase letters, numbers, dots(.), dashes(-) and needs to begin with a letter or a number."
        },
        "04City" : {
          "Description" : "City",
          "Type" : "String"
        },

        "05Country" : {
          "Description" : "Country",
          "Type" : "String",
          "AllowedValues" : ["Andorra","United Arab Emirates","Afghanistan","Antigua and Barbuda","Anguilla","Albania","Armenia","Netherlands Antilles", "Angola", "Antarctica","Argentina","American Samoa","Austria","Australia","Aland Islands","Aruba","Azerbaidjan","Bosnia and Herzegovina", "Barbados", "Bangladesh", "Belgium","Burkina Faso","Bulgaria","Bahrain","Burundi","Benin","Saint Barthelemey","Bermuda","Brunei Darussalam", "Bolivia", "Brazil", "Bahamas", "Bhutan","Bouvet Island","Botswana","Belarus","Belize","Canada","Cocos Islands","Congo, Democratic Rebpulic of the","Central African Republic", "Congo","Switzerland","Ivory Coast","Cook Islands","Chile","Cameroon","China","Colombia","Costa Rica","Cuba","Cape Verde","Christmas Island", "Cyprus","Czech Republic","Germany","Djibouti","Denmark","Dominica","Dominican Republic", "Algeria", "Ecuador", "Estonia", "Egypt", "Western Sahara", "Eritrea","Spain","Ethiopia","Finland","Fiji","Falkland Islands","Micronesia","Faroe Islands","France","Gabon","Great Britain", "Grenada", "Georgia", "French Guyana", "Guernsey", "Ghana", "Gibraltar", "Greenland"," Gambia", "Guinea", "Guadeloupe","Equatorial Guinea","Greece","S. Georgia & S. Sandwich Isls.", "Guatemala","Guam (USA)","Guinea Bissau","Guyana","Hong Kong","Heard and McDonald Islands", "Honduras", "Croatia", "Haiti", "Hungary", "Indonesia","Ireland","Israel","Isle of Man","India","British Indian Ocean Territory", "Iraq", "Iran", "Iceland", "Italy", "Jersey", "Jamaica", "Jordan","Japan","Kenya","Kyrgyz Republic (Kyrgyzstan)","Cambodia, Kingdom of","Kiribati","Comoros","Saint Kitts & Nevis Anguilla","North Korea", "South Korea","Kuwait","Cayman Islands","Kazakhstan","Laos","Lebanon","Saint Lucia","Liechtenstein","Sri Lanka", "Liberia", "Lesotho", "Lithuania", "Luxembourg","Latvia","Libya","Morocco","Monaco","Moldavia","Montenegro","Saint Martin (French)","Madagascar", "Marshall Islands", "Macedonia", "Mali","Myanmar","Mongolia","Macau","Northern Mariana Islands","Martinique (French)","Mauritania", "Montserrat", "Malta", "Mauritius", "Maldives", "Malawi","Mexico","Malaysia","Mozambique","Namibia","New Caledonia (French)","Niger","Norfolk Island", "Nigeria", "Nicaragua", "Netherlands", "Norway","Nepal","Nauru","Niue","New Zealand","Oman","Panama","Peru","Polynesia (French)","Papua New Guinea", "Philippines", "Pakistan", "Poland","Saint Pierre and Miquelon","Pitcairn Island","Puerto Rico","Palestinian Territory (Occupied)","Portugal", "Palau", "Paraguay", "Qatar", "Reunion (French)","Romania","Serbia","Russian Federation","Rwanda","Saudi Arabia","Solomon Islands", "Seychelles", "Sudan", "Sweden", "Singapore","Saint Helena","Slovenia","Svalbard Jan Mayen Islands","Slovak Republic","Sierra Leone","San Marino", "Senegal", "Somalia", "Suriname", "Saint Tome and Principe","El Salvador","Syria","Swaziland","Turks and Caicos Islands","Chad","French Southern Territories", "Togo", "Thailand", "Tadjikistan", "Tokelau","Timor-Leste","Turkmenistan","Tunisia","Tonga","Turkey","Trinidad and Tobago", "Tuvalu", "Taiwan", "Tanzania", "Ukraine", "Uganda", "United Kingdom","USA Minor Outlying Islands","United States","Uruguay","Uzbekistan","Holy See (Vatican City State)","Saint Vincent & Grenadines", "Venezuela","Virgin Islands (British)","Virgin Islands (USA)","Vietnam","Vanuatu","Wallis and Futuna Islands", "Samoa", "Yemen", "Mayotte","South Africa","Zambia","Zimbabwe"]
        },
        "06Email": {
            "Default": "",
            "Description": "UTM admin email",
            "Type": "String"
        },
        "07Organization" : {
          "Description" : "Name of your Organization",
          "Type" : "String"
        },

        "08AdminPassword" : {
          "Description" : "UTM admin password",
          "Type" : "String",
          "NoEcho" : "True"
        },
        "09KeyName" : {
            "Description" : "Name of an existing EC2 KeyPair to enable SSH access.",
            "Type": "AWS::EC2::KeyPair::KeyName",
            "Default" : ""
        },
        "10TrustedNetwork" : {
            "Description" : "Trusted network. Only connections from this network are allowed to ports 22 and 8080. E.g 92.198.130.0/24",
            "Type" : "String",
            "Default" : "0.0.0.0/0"
        },
        "VPC" : {
            "Description" : "VPC Id to deploy resources into",
            "Type" : "String"
        },
        "Subnet1" : {
            "Description" : "Public_Subnet_AZ1_Outside",
            "Type" : "String"
        },
        "Subnet2" : {
            "Description" : "Public_Subnet_AZ2_Outside",
            "Type" : "String"
        },
        "ExistingS3Bucket" : {
            "Description" : "Optional. The S3 Bucket to store and restore backups. If left empty a new bucket will be created automatically.",
            "Type" :  "String",
            "Default": ""
            },

        "ExistingElasticIP" : {
            "Description" : "Optional. The Elastic IP to assign in the UTM instance. If left empty a new Elastic IP will be allocated automatically.",
            "Type" :  "String",
            "Default": ""
            },

        "LicensePool" : {
          "Description" : "Optional. S3 bucket where the licenses are stored",
          "Type" : "String",
          "Default": ""
        }
    },

    "Conditions" : {
        "CreateS3Bucket" : { "Fn::Equals" : [{"Ref" : "ExistingS3Bucket"}, ""] },
        "AllocateElasticIP" : { "Fn::Equals" : [{"Ref" : "ExistingElasticIP"}, ""] }
    },

    "Resources": {

        "PublicNetworkAcl" : {
            "Type" : "AWS::EC2::NetworkAcl",
            "Properties" : {
                "VpcId" : { "Ref" : "VPC" },
                "Tags" : [
                    {"Key" : "Application", "Value" : { "Ref" : "AWS::StackId"} },
                    {"Key" : "Network", "Value" : "Public" }
                ]
            }
        },

        "InboundHTTPPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "100",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "false",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "80", "To" : "80"}
            }
        },

        "InboundDynamicPortsPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "200",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "false",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "1024", "To" : "65535"}
            }
        },

        "InboundSSHPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "300",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "false",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "22", "To" : "22"}
            }
        },

        "InboundRedUDPPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "400",
                "Protocol" : "17",
                "RuleAction" : "allow",
                "Egress" : "false",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "3410", "To" : "3410"}
            }
        },

        "OutboundSSHPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "105",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "22", "To" : "22"}
            }
        },

        "OutboundHTTPPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "205",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "80", "To" : "80"}
            }
        },

        "OutBoundDynamicPortPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "305",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "1024", "To" : "65535"}
            }
        },

        "OutboundHTTPSPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "405",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "443", "To" : "443"}
            }
        },

        "OutboundRedPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "406",
                "Protocol" : "6",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "3000", "To" : "3000"}
            }
        },

        "OutboundRedUDPPublicNetworkAclEntry" : {
            "Type" : "AWS::EC2::NetworkAclEntry",
            "Properties" : {
                "NetworkAclId" : {"Ref" : "PublicNetworkAcl"},
                "RuleNumber" : "407",
                "Protocol" : "17",
                "RuleAction" : "allow",
                "Egress" : "true",
                "CidrBlock" : "0.0.0.0/0",
                "PortRange" : {"From" : "3410", "To" : "3410"}
            }
        },

        "IPAddress" : {
            "Type" : "AWS::EC2::EIP",
            "Condition": "AllocateElasticIP",
            "Properties" : {
                "Domain": "vpc"
            }
        },

        "S3Bucket" : {
            "Type" : "AWS::S3::Bucket",
            "Condition" : "CreateS3Bucket",
            "DeletionPolicy" : "Retain",
            "Properties" : {
                "LifecycleConfiguration" : {
                    "Rules" : [
                      {
                        "Prefix" : "confd_backup",
                        "ExpirationInDays" : "3",
                        "Status" : "Enabled"
                      },
                      {
                        "Prefix" : "postgres_basebackup",
                        "ExpirationInDays" : "3",
                        "Status" : "Enabled"
                      },
                      {
                        "Prefix" : "postgres_wal",
                        "ExpirationInDays" : "3",
                        "Status" : "Enabled"
                      }
                    ]
                }
            }
        },

        "UTMRole" : {
            "Type" : "AWS::IAM::Role",
            "Properties" : {
                "AssumeRolePolicyDocument" : {
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Principal": {
                            "Service": [ "ec2.amazonaws.com" ]
                        },
                        "Action": [ "sts:AssumeRole" ]
                    }]
                },
                "Path": "/",
                "Policies": [{
                    "PolicyName" : "UTMPolicy",
                    "PolicyDocument" : {
                        "Version": "2012-10-17",
                        "Statement": [
                        {
                            "Effect": "Allow",
                            "Action": "iam:PassRole",
                            "Resource": "*"
                        },
                        {
                            "Effect": "Allow",
                            "NotAction": "iam:*",
                            "Resource": "*"
                        },
                        {
                            "Effect": "Allow",
                            "Action": "cloudformation:UpdateStack",
                            "Resource": "*"
                        }]
                    }
                }]
            }
        },

        "UTMInstanceProfile": {
            "Type": "AWS::IAM::InstanceProfile",
            "Properties": {
                "Path": "/",
                "Roles": [{
                    "Ref": "UTMRole"
                }]
            }
        },

        "UTMSecurityGroup": {
            "Type" : "AWS::EC2::SecurityGroup",
            "Properties" : {
                "GroupDescription" : "Identifying security group",
                "VpcId" : { "Ref" : "VPC" }
            }
        },

        "TrustedNetworkGroup": {
            "Type" : "AWS::EC2::SecurityGroup",
            "Properties" : {
                "GroupDescription" : "Enable TCP access from trusted network",
                "SecurityGroupIngress" : [ {
                    "IpProtocol" : "tcp",
                    "FromPort" : "0",
                    "ToPort" : "65535",
                    "CidrIp" : { "Ref" : "10TrustedNetwork"}
                  } ],
                  "VpcId" : { "Ref" : "VPC" }
            }
        },

        "UntrustedGroup" : {
            "Type" : "AWS::EC2::SecurityGroup",
            "Properties" : {
                "GroupDescription" : "Untrusted network restricted from accessing port 22 and 8080.",
                "SecurityGroupIngress" : [
                    {
                        "IpProtocol" : "tcp",
                        "FromPort" : "12",
                        "ToPort" : "21",
                        "CidrIp" : "0.0.0.0/0"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "FromPort" : "23",
                        "ToPort" : "8079",
                        "CidrIp" : "0.0.0.0/0"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "FromPort" : "8081",
                        "ToPort" : "65535",
                        "CidrIp" : "0.0.0.0/0"
                    },
                    {
                        "IpProtocol" : "udp",
                        "FromPort" : "3410",
                        "ToPort" : "3410",
                        "CidrIp" : "0.0.0.0/0"
                    }
                ],
                "VpcId" : { "Ref" : "VPC" }
            }
        },

        "UTMScalingGroup": {
            "Type" : "AWS::AutoScaling::AutoScalingGroup",
            "UpdatePolicy" : {
                "AutoScalingRollingUpdate" : {
                    "MinInstancesInService" : "1",
                    "MaxBatchSize" : "1",
                    "PauseTime" : "PT5M"
                }
            },
            "Properties" : {
                "DesiredCapacity" : "1",
                "MaxSize" : "2",
                "MinSize" : "1",
                "TerminationPolicies" : [
                  "NewestInstance"
                ],
                "VPCZoneIdentifier" : [
                    { "Ref" : "Subnet1" },
                    { "Ref" : "Subnet2" }
                ],
                "LaunchConfigurationName" : {"Ref": "UTMLaunchConfiguration"},
                "NotificationConfiguration" : {
                    "TopicARN" : { "Ref" : "UnhealthyTopic" },
                    "NotificationTypes" : [
                        "autoscaling:EC2_INSTANCE_LAUNCH",
                        "autoscaling:EC2_INSTANCE_LAUNCH_ERROR",
                        "autoscaling:EC2_INSTANCE_TERMINATE",
                        "autoscaling:EC2_INSTANCE_TERMINATE_ERROR"
                    ]
                },
                "Tags" : [{
                    "Key" : "Name",
                    "Value" : "HA-UTM",
                    "PropagateAtLaunch" : "true"
                }]
            }
        },

        "UTMLaunchConfiguration": {
            "Type" : "AWS::AutoScaling::LaunchConfiguration",
            "Properties" : {
                "AssociatePublicIpAddress" : true,
                "IamInstanceProfile" : { "Ref" : "UTMInstanceProfile" },
                "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, {"Ref": "01LicenseType"} ]},
                "InstanceType" : { "Ref" : "02InstanceType" },
                "KeyName" : { "Ref" : "09KeyName" },
                "BlockDeviceMappings" : [{
                    "DeviceName" : "/dev/sda",
                    "Ebs" : { "VolumeSize" : "100" }
                  }],
                "SecurityGroups" : [
                    { "Ref": "UTMSecurityGroup" },
                    { "Ref": "TrustedNetworkGroup" },
                    { "Ref": "UntrustedGroup" }
                ],
                "UserData" : { "Fn::Base64" : { "Fn::Join" : [ "", [
                    "#!/bin/bash\n",
                    "echo AWS_REGION=",{ "Ref" : "AWS::Region" },">>/etc/environment\n",
                    "export AWS_REGION=",{ "Ref" : "AWS::Region" },"\n",
                    "echo EC2_URL=",{ "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "EC2API" ]},">>/etc/environment\n",
                    "export EC2_URL=",{ "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "EC2API" ]},"\n",
                    "date +'UserData start %c' > /tmp/user_data.log\n",
                    "echo 'version: \"0.1.0\"' >> /etc/cloud/user_data.yml\n",
                    "echo 'instance_role: \"ha_standalone\"' >> /etc/cloud/user_data.yml\n",
                    "echo 'deployment_type: \"ha_warm_standby\"' >> /etc/cloud/user_data.yml\n",
                    "echo 'license_pool: \"", { "Ref": "LicensePool" }, "\"' >> /etc/cloud/user_data.yml\n",
                    "cc=`/usr/local/bin/confd-client.plx country_name_to_code \"",{ "Ref": "05Country" },"\"`\n",
                    "echo \"{ hostname => '", { "Ref": "03Hostname" }, "', organization => '", { "Ref": "07Organization"}, "', city => '", { "Ref" : "04City" },"', country => '$cc', email => '", { "Ref": "06Email" }, "', password => '", { "Ref": "08AdminPassword" }, "' }\" > /var/confd/var/storage/setup.ph\n",

                    "/etc/init.d/confd restart\n",
                    "sleep 5\n",
                    "echo 'elastic_ip: \"",
                        { "Fn::If" : [
                                "AllocateElasticIP",
                                { "Ref" : "IPAddress" },
                                { "Ref" : "ExistingElasticIP" }
                            ]
                        },"\"' >> /etc/cloud/user_data.yml\n",
                    "echo 's3_bucket: \"",
                        { "Fn::If" : [
                                "CreateS3Bucket",
                                { "Ref" : "S3Bucket" },
                                { "Ref" : "ExistingS3Bucket" }
                            ]
                        },"\"' >> /etc/cloud/user_data.yml\n",

                    "echo 'stack_name: \"", { "Ref": "AWS::StackName"} ,"\"' >> /etc/cloud/user_data.yml\n",

                    "date +'UserData confd config start %c' >> /tmp/user_data.log\n",

                    "echo '{' > /tmp/user_data.config\n",
                    "echo '\"cloudwatch\" => { \"status\" => 1 },' >> /tmp/user_data.config\n",
                    "echo '\"confd\" => { \"backup\" => 1, \"backup_interval\" => 300, \"restore\" => 1, \"restore_done\" => 0 },' >> /tmp/user_data.config\n",
                    "echo '\"instance_role\" => \"ha_standalone\",' >> /tmp/user_data.config\n",
                    "echo '\"postgres\" => { \"archive_timeout\" => 300, \"backup\" => 1, \"base_backup_interval\" => 3600, \"restore\" => 1 },' >> /tmp/user_data.config\n",
                    "echo '\"syslog\" => { \"backup\" => 1, \"restore\" => 1, \"restore_period\" => 8 },' >> /tmp/user_data.config\n",
                    "echo '\"s3_bucket\" => \"",
                        { "Fn::If" : [
                                "CreateS3Bucket",
                                { "Ref" : "S3Bucket" },
                                { "Ref" : "ExistingS3Bucket" }
                            ]
                        },"\",' >> /tmp/user_data.config\n",

                    "echo '\"stack_name\" => \"", { "Ref": "AWS::StackName"},"\",' >> /tmp/user_data.config\n",

                    "echo '\"elastic_ip\" => \"",
                        { "Fn::If" : [
                                "AllocateElasticIP",
                                { "Ref" : "IPAddress" },
                                { "Ref" : "ExistingElasticIP" }
                            ]
                        }, "\",' >> /tmp/user_data.config\n",

                    "echo '\"trusted_network\" => \"", { "Ref": "10TrustedNetwork"},"\"' >> /tmp/user_data.config\n",
                    "echo '}' >> /tmp/user_data.config\n",

                    "/usr/local/bin/confd-client.plx -noquote -stdin set \\'ha\\' \\'aws\\' < /tmp/user_data.config >> /tmp/user_data.log\n",

                    "date +'UserData confd config end %c' >> /tmp/user_data.log\n",

                    "date +'UserData ha aws start %c' >> /tmp/user_data.log\n",
                    "/etc/init.d/ha_aws start\n",

                    "date +'UserData awslogs agent setup start %c' >> /tmp/user_data.log\n",
                    "/usr/local/bin/awslogs-agent-setup-v1.0.py -n -r ", { "Ref" : "AWS::Region" }, "  -c /etc/cloud/awslogs.conf >> /tmp/user_data.log\n",

                    "date +'UserData awslogs agent setup end %c' >> /tmp/user_data.log\n",

                    "/usr/local/bin/confd-client.plx trigger ha_aws\n",

                    "exit 0\n"
                ] ] } }
            }
        },


        "IngressTrafficMinimal": {
            "Type": "AWS::CloudWatch::Alarm",
            "Properties": {
                "AlarmDescription": "Terminate if the incoming traffic is suspiciously low",
                "MetricName": "NetworkIn",
                "Namespace": "AWS/EC2",
                "Statistic": "Sum",
                "Period": "60",
                "EvaluationPeriods": "2",
                "Threshold": "100",
                "AlarmActions": [ { "Ref": "UnhealthyTopic" } ],
                "Dimensions": [{
                    "Name": "AutoScalingGroupName",
                    "Value": { "Ref": "UTMScalingGroup" }
                }],
                "ComparisonOperator": "LessThanThreshold"
            }
        },

        "EgressTrafficMinimal": {
            "Type": "AWS::CloudWatch::Alarm",
            "Properties": {
                "AlarmDescription": "Terminate if the outgoing traffic is suspiciously low",
                "MetricName": "NetworkOut",
                "Namespace": "AWS/EC2",
                "Statistic": "Sum",
                "Period": "60",
                "EvaluationPeriods": "2",
                "Threshold": "100",
                "AlarmActions": [ { "Ref": "UnhealthyTopic" } ],
                "Dimensions": [ {
                    "Name": "AutoScalingGroupName",
                    "Value": { "Ref": "UTMScalingGroup" }
                }],
                "ComparisonOperator": "LessThanThreshold"
            }
        },

        "UnhealthyTopic": {
            "Type": "AWS::SNS::Topic",
            "Properties": {
                "Subscription": [{
                    "Endpoint": { "Ref": "06Email" },
                    "Protocol": "email"
                }]
            }
        }
    },

    "Outputs" : {
        "PublicIPAddress" : {
            "Value" : { "Ref" : "IPAddress" },
            "Description" : "Use this IP to connect and to forward traffic to the UTM."
        },
        "ScalingGroup" : {
            "Value" : { "Ref": "UTMScalingGroup" },
            "Description" : "The HA Scaling group."
        },
        "S3Bucket" : {
            "Value" : { "Ref": "S3Bucket" },
            "Description" : "The S3 Bucket."
        }
    }
}

Answer 1

https://www.sophos.com/en-us/support/knowledgebase/122202.aspx

从表面上看，confd-client.plx 完成了大部分功能(通过 user_data.config 进行构建，正如您在用户数据部分中猜测的那样)。
UTMRole基本上具有将弹性ip绑定(bind)到实例的权限。

顺便说一句，您无法(轻松)将弹性 IP 与自动调用组关联(因为就其本质而言，它们是短暂的)。自动调用基本上与模板中的LaunchConfig相关联。

顺便说一句，这对于 Sophos 的东西来说是高度特定的，这不是人们通常在 AWS 上使用 Cloudformation 的方式。