amazon-web-services - 如何在Cloudformation模板中将EIP分配给VPC的Autoscaling组

Question

我想将我保留的弹性 IP(ec2 classic ip)之一分配给 VPC 中的自动扩展组。使用 AWS Cli 我将 ip 移动到 vpc:

$ aws ec2 move-address-to-vpc --public-ip 23.23.23.23

并在aws conole中看到，该IP已传递到VPC。并在资源中的Cloudformation模板中的AutoscalingGroup标签中分配:

"Process": {
        "Type" : "AWS::AutoScaling::AutoScalingGroup",
        "Properties": {
            "LaunchConfigurationName": {"Ref": "PreprocessorLC"},
            "LoadBalancerNames": [{"Ref": "ProcessELB"}],
            "VPCZoneIdentifier" : [{ "Fn::Join" : [",", [ { "Ref" : "PublicSubnet1"}, { "Ref" : "PublicSubnet2"} ]]}],
            "AvailabilityZones": {"Ref": "AZs"},
            "MinSize" : "1",
            "MaxSize" : "1",
            "HealthCheckGracePeriod": 300,
            "Tags" : [
                {"Key": "Name", "Value": {"Fn::Join": ["", [{"Ref": "Env"}, "-Process"]]}, "PropagateAtLaunch": true},
                {"Key": "WorkersScalingGroup", "Value": {"Fn::Join": ["", ["Offering-", {"Ref": "Env"},  "-Process-Worker"]]}, "PropagateAtLaunch": true},
                {"Key": "EIP", "Value": {"Ref": "ProcessIP"}, "PropagateAtLaunch": true},
                {"Key": "Environment", "Value": {"Ref": "Env"}, "PropagateAtLaunch": true}
            ]
        }
    }

参数中“ProcessIP”的附加值:

"ProcessIP":{
            "Description": "DEV: 23.23.23.23",
            "Type": "String",
            "Default": "23.23.23.23",
            "AllowedValues": ["23.23.23.23"]
}

但它不起作用。仍然获得随机IP。如果有人可以告诉我哪里错了或者应该添加什么才能使它工作？

谢谢!

Answer 1

就我而言，我需要保留一组未分配的 EIP，并在 EC2 启动时将它们随机分配给它们。这样我就始终知道我的服务器将使用特定的 IP 列表，我可以在其他地方将其列入白名单。

如果您创建多个名为“prod-pool”的 EIP，则可以使用此脚本。

apt install -y jq awscli
ALLOCATION_ID=`aws ec2 describe-addresses --filters="Name=tag:Name,Values=prod-pool" | jq -r '.Addresses[] | "\(.InstanceId) \(.AllocationId)"' | grep null | awk '{print $2}' | xargs shuf -n1 -e`

if [ ! -z $ALLOCATION_ID ]; then
    aws ec2 associate-address --instance-id $INSTANCE_ID --allocation-id $ALLOCATION_ID --allow-reassociation
fi

您可以将此策略附加到您的 IAM 用户

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEIPAttachment",
      "Effect": "Allow",
      "Resource": [
        "*"
      ],
      "Action": [
        "ec2:AssociateAddress",
        "ec2:DisassociateAddress"
      ]
    }
  ]
}