amazon-web-services - Cloudformation 中的 VPC 终端节点 - 终端节点类型(网关)与可用服务类型([接口(interface)])不匹配

Question

我尝试在 Cloudformation 中为 API Gateway 创建 VPC 终端节点，但收到此错误:

Endpoint type (Gateway) does not match available service types ([Interface]).

下面的模板位于资源部分:

  executeApiEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: "*"
            Action:
              - "execute-api:Invoke"
              - "execute-api:ManageConnections"
            Resource:
              - "arn:aws:execute-api:*:*:*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
      VpcId: !Ref pubPrivateVPC

这个也不起作用:

  executeApiEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal: "*"
            Action:
              - "execute-api:*"
            Resource:
              - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
      VpcId: !Ref pubPrivateVPC

但是，这个 block (来自模板)能够执行而不会出现任何错误:

  s3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal: "*"
            Action:
              - "s3:*"
            Resource:
              - "*"
      RouteTableIds:
        - !Ref privateRouteTable
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcId: !Ref pubPrivateVPC

这里出了什么问题？

Answer 1

您还必须指定 VpcEndpointType property将 AWS::EC2::VPCEndpoint 资源配置为 Interface，以便接口(interface)类型的 VPC 终端节点能够正常工作。默认值为“网关”，仅适用于 S3 和 DynamoDB VPC 终端节点。

您的解决方案使用 S3 作为端点的原因是因为 VpcEndpointType 属性将“Gateway”作为默认值(适用于 S3)。