amazon-web-services - 创建安全组导致 cloudform 模板出错

Question

我正在尝试创建一个取证基础设施，该基础设施应具有 VPC、ForensicSecurityGroup 和 IsolatedSecurityGroup。仅允许来自 ForensicSecurityGroup 的入站 SSH 进入 IsolatedSecurityGroup。

在运行我的模板时，创建 IsolatedSecurityGroup 时会报告以下错误。

You have specified two resources that belong to different networks. 
(Service: AmazonEC2; Status Code: 400; Error Code: InvalidGroup.NotFound; Request ID: 1581ea3a-b9ad-4b06-bdd7-518c9d710e5e; Proxy: null)

这是我的模板的样子:

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Template for immediately isolation and forensic investigation of compromised instances
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  Ec2KeyName:
    Type: AWS::EC2::KeyPair::KeyName
  PurposeTag:
    Type: String
    Default: forensics
  SSHLocation:
    Description: >-
      Enter desired Network CIDR to access EC2 instance. Default is set to
      access from anywhere and it is not recommended. Please change to appropriate
      CIDR.
    AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
    MinLength: '9'
    MaxLength: '18'
    Default: 0.0.0.0/0
    Type: String
    ConstraintDescription: >-
      Must be a valid Network CIDR of the form x.x.x.x/y. Default is set to
      0.0.0.0/0, in production do not set default to 0.0.0.0/0  

Mappings:
  ImageId:
    us-east-1:
      AmazonLinux2: ami-00dc79254d0461090
      UbuntuCanonical: ami-04b9e92b5572fa0d1
    us-east-2:
      AmazonLinux2: ami-00bf61217e296b409
      UbuntuCanonical: ami-0d5d9d301c853a04a
    us-west-1:
      AmazonLinux2: ami-024c80694b5b3e51a
      UbuntuCanonical: ami-0dd655843c87b6930
    us-west-2:
      AmazonLinux2: ami-0a85857bfc5345c38
      UbuntuCanonical: ami-06d51e91cea0dac8d
    eu-west-1:
      AmazonLinux2: ami-040ba9174949f6de4
      UbuntuCanonical: ami-02df9ea15c1778c9c

Resources:
  ForensicSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for forensic EC2 instances
      SecurityGroupIngress:
        - Description: Allow SSH from company ip address
          CidrIp: !Ref SSHLocation
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      Tags:
        - Key: Purpose
          Value: !Ref PurposeTag

  ForensicInstance:
    Type: AWS::EC2::Instance
    Metadata:
      AWS::CloudFormation::Init:
        config:
          commands:
            1_sift_download:
              command: "wget https://github.com/teamdfir/sift-cli/releases/download/v1.7.1/sift-cli-linux -P /tmp/"
            2_rename:
              command: "mv /tmp/sift-cli-linux /usr/local/bin/sift"
            3_sift_permissions:
              command: "chmod 755 /usr/local/bin/sift"
            4_sift_install:
              command: "/usr/local/bin/sift install"
    Properties:
      IamInstanceProfile: !Ref ForensicInstanceProfile
      ImageId: !FindInMap
        - ImageId
        - !Ref 'AWS::Region'
        - UbuntuCanonical

      InstanceType: t2.micro
      KeyName: !Ref Ec2KeyName
      SecurityGroupIds:
        - !GetAtt ForensicSecurityGroup.GroupId
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          apt update
          apt -y install python-pip
          pip install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-latest.tar.gz
          cfn-init -s ${AWS::StackName} --region ${AWS::Region} -r ForensicInstance
      Tags:
        - Key: Purpose
          Value: !Ref PurposeTag

  ForensicInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref ForensicInstanceRole

  ForensicInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action: sts:AssumeRole
            Principal:
              Service: ec2.amazonaws.com
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2FullAccess

  IsolatedSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group that allows only SSH from the forensics group
      SecurityGroupIngress:
        - Description: Allow SSH
          SourceSecurityGroupId: !GetAtt ForensicSecurityGroup.GroupId
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      SecurityGroupEgress:
        - Description: Limit outbound traffic to only localhost, removes the default quad-zero outbound rule
          CidrIp: 0.0.0.0/0
          IpProtocol: '-1'
      VpcId: !Ref VpcId
      Tags:
        - Key: Purpose
          Value: !Ref PurposeTag

有人可以帮我理解这里的错误原因吗？这更像是循环依赖还是完全不同？

Answer 1

您忘记为取证安全组指定 VPCID，因此它将在默认 VPC 中分配。

您应该添加VpcId: !Ref VpcId到ForensicInstance