amazon-web-services - 在 CloudFormation 中创建 ALB 目标组

Question

我正在尝试在 CloudFormation 中创建一个应用程序负载均衡器，其中的目标组将流量转发到 EC2 实例。以下是相关代码片段，其中 ELBSubnets、ECSCluster、taskdefinition 和 VpcId 作为参数传入:

"EcsElasticLoadBalancer" : {
  "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
  "Properties" : {
    "Subnets" : { "Ref" : "ELBSubnets" },
    "SecurityGroups": [
      { "Ref": "ELBAccessSecurityGroup" }
    ]
  }
},
"LoadBalancerListener": {
  "Type": "AWS::ElasticLoadBalancingV2::Listener",
  "Properties": {
    "DefaultActions": [{
      "Type": "forward",
      "TargetGroupArn": { "Ref": "TargetGroup" }
    }],
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" },
    "Port": 80,
    "Protocol": "HTTP"
  }
},
"TargetGroup": {
  "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
  "Properties": {
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] },
    "Port": 80,
    "Protocol": "HTTP",
    "VpcId": { "Ref": "VpcId" }
  },
  "DependsOn": [ "EcsElasticLoadBalancer" ]
},
"service": {
  "Type": "AWS::ECS::Service",
  "Properties" : {
    "Cluster": { "Ref": "ECSCluster" },
    "DesiredCount": "1",
    "LoadBalancers": [
      {
        "ContainerName": "main-app",
        "ContainerPort": 3000,
        "TargetGroupArn": { "Ref": "TargetGroup" }
      }
    ],
    "Role" : {"Ref":"ECSServiceRole"},
    "TaskDefinition" : {"Ref":"taskdefinition"}
  }
},
"ECSServiceRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": [
              "ecs.amazonaws.com"
            ]
          },
          "Action": [
            "sts:AssumeRole"
          ]
        }
      ]
    },
    "Path": "/",
    "Policies": [
      {
        "PolicyName": "ecs-service",
        "PolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "elasticloadbalancing:Describe*",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "ec2:Describe*",
                "ec2:AuthorizeSecurityGroupIngress"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    ]
  }
}

创建服务时出现以下错误:

The target group with targetGroupArn arn:aws:elasticloadbalancing:us-east-1:xxxxxxxx:targetgroup/AlbServiceStack-TargetGroup/6ba9c037c26cdb36 does not have an associated load balancer.

我错过了什么？在文档中似乎没有办法为目标组指定负载均衡器。

Answer 1

成功了 - 问题是双重的:

1. 角色策略文档中缺少以下几行:
   • “elasticloadbalancing:DeregisterTargets”
   • “elasticloadbalancing:RegisterTargets”
2. 服务需要 "DependsOn": [ "LoadBalancerListener"] 作为附加属性。

更新后的模板如下所示:

"EcsElasticLoadBalancer" : {
  "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer",
  "Properties" : {
    "Subnets" : { "Ref" : "ELBSubnets" },
    "SecurityGroups": [
      { "Ref": "ELBAccessSecurityGroup" }
    ]
  }
},
"LoadBalancerListener": {
  "Type": "AWS::ElasticLoadBalancingV2::Listener",
  "Properties": {
    "DefaultActions": [{
      "Type": "forward",
      "TargetGroupArn": { "Ref": "TargetGroup" }
    }],
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" },
    "Port": 80,
    "Protocol": "HTTP"
  }
},
"TargetGroup": {
  "Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
  "Properties": {
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] },
    "Port": 80,
    "Protocol": "HTTP",
    "VpcId": { "Ref": "VpcId" }
  },
  "DependsOn": [ "EcsElasticLoadBalancer" ]
},
"service": {
  "Type": "AWS::ECS::Service",
  "DependsOn": [ "LoadBalancerListener" ],
  "Properties" : {
    "Cluster": { "Ref": "ECSCluster" },
    "DesiredCount": "1",
    "LoadBalancers": [
      {
        "ContainerName": "main-app",
        "ContainerPort": 3000,
        "TargetGroupArn": { "Ref": "TargetGroup" }
      }
    ],
    "Role" : {"Ref":"ECSServiceRole"},
    "TaskDefinition" : {"Ref":"taskdefinition"}
  }
},
"ECSServiceRole": {
  "Type": "AWS::IAM::Role",
  "Properties": {
    "AssumeRolePolicyDocument": {
      "Statement": [
        {
          "Effect": "Allow",
          "Principal": {
            "Service": [
              "ecs.amazonaws.com"
            ]
          },
          "Action": [
            "sts:AssumeRole"
          ]
        }
      ]
    },
    "Path": "/",
    "Policies": [
      {
        "PolicyName": "ecs-service",
        "PolicyDocument": {
          "Statement": [
            {
              "Effect": "Allow",
              "Action": [
                "elasticloadbalancing:Describe*",
                "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
                "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
                "ec2:Describe*",
                "ec2:AuthorizeSecurityGroupIngress",
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:RegisterTargets"
              ],
              "Resource": "*"
            }
          ]
        }
      }
    ]
  }
}