为什么 cfn-init 会回复这个奇怪的消息？

Question

I have trouble getting cfn-init to work on Windows.

I do this:

cfn-init.exe -v -c config 
  -s arn:aws:cloudformation:eu-north-1:894422057177:stack/Providence-Core-A47K89HAVG6V/20f830c0-05cd-12ea-9527-06c34fc32621 
  -r MyHost  
  --region eu-north-1

(line breaks added for clarity)

and get as a result:

('Connection aborted.', error(10060, 'A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond'))

What causes this error? What is it that cannot be reached? (it is not the most verbose error message I've seen:-))

Is cfn-init.exe actually trying to access something on the network? If so, what target address? My outbound rules are fairly restrictive both when it comes to Network ACL and SecurityGroup. They don't have general outbound access for http/https. Is that the reason?

Answer 1

Bottom line: yes, the cfn-init command indeed does an outbound https request. Your SecurityGroup, Subnet ACLs, etc, must allow this.

The cfn-init command attempts to download the relevant CloudFormation stack from the AWS CloudFormation endpoint which is on Public Internet. Therefore, if the cfn-init feature is used, the EC2 instance must have outbound access to such endpoint.

If you don't want to grant generic outbound access for your EC2 instance then Amazon offers a VPC Endpoint for the AWS CloudFormation service .