autsaling launchconfig組中的aws cloudformation“NetworkInterfaces”

Question

在aws cloudformation中如何在Autoscaling launchconfig組中添加“NetworkInterfaces”，因為我想配置每個啟動的實例，我需要“NetworkInterfaces”在同一個AWS :: EC2 :: Instance？

Answer 1

我目前使用的解決方案是確保使用允許包含策略的IAM實例配置文件啟動每個實例

"PolicyDocument": {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:CreateTags",
                "ec2:DescribeSubnets",
                "ec2:AttachNetworkInterface",
                "ec2:CreateNetworkInterface",
                "ec2:ModifyNetworkInterfaceAttribute"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

用於創建AutoScalingGroup和LaunchConfiguration的 My Cloud Formation模板接收子網和安全組的參數以附加到每個其他ENI 。

"SecondaryNICSubnetIds":{
    "Type" : "CommaDelimitedList",
    "Description" : "Ensure that the spread of Availability Zones for these Subnets matches the SubnetIds used to create Instances, as when creating a Secondary ENI it must exist in the same AZ as the Instance"
},
"SecondaryNICSecurityGroupIds":{
    "Type" : "CommaDelimitedList",
    "Description" : "Security Groups to associate to the Secondary ENI"
},

然后LaunchConfiguration包含一個UserData屬性

1. 確保安裝awscli
2. 通過解析實例元數據標識文檔來設置要使用的區域
3. 從實例元數據中獲取實例ID
4. 從實例元數據中獲取實例的可用區域
5. 從傳入的子網中，通過使用awscli describe-subnets調用找到與我的實例AZ匹配的第一個子網
6. 在我選擇的子網中創建網絡接口，並使用awscli create-network-interface調用向其添加安全組
7. 使用awscli create-tags調用標記我的ENI
8. 使用awscli attach-network-interface調用將ENI附加到我的實例
9. 使用modify-network-interface-attribute調用修改附件以刪除實例終止上的ENI

"UserData": {
      "Fn::Base64" : {
        "Fn::Join": [ "\n",
          [
            "#!/bin/bash -xe",
            "sudo apt-get install -y awscli",
            "export AWS_DEFAULT_REGION=$(curl -sS http://169.254.169.254/latest/dynamic/instance-identity/document | python -c 'import sys, json; print(json.load(sys.stdin)[\"region\"])')",
            "INSTANCE_ID=$(curl -sS http://169.254.169.254/latest/meta-data/instance-id)",
            "AZ=$(curl -sS http://169.254.169.254/latest/meta-data/placement/availability-zone)",
            "echo Availability Zone: ${AZ}",
            {"Fn::Sub":[
                "SUBNET_ID=$(aws ec2 describe-subnets --subnet-ids ${SubnetNetIds} --filters Name=availabilityZone,Values=${!AZ} --query 'Subnets[0].SubnetId' --output text)",
                {"SubnetNetIds":  {"Fn::Join": [" ", {"Ref": "SecondaryNICSubnetIds"} ] }}
            ]},
            "echo Subnet Id: ${SUBNET_ID}",
            {"Fn::Sub":[
              "ENI_ID=$(aws ec2 create-network-interface --subnet ${!SUBNET_ID} --description 'Secondary ENI' --groups ${SecurityGroups} --query 'NetworkInterface.NetworkInterfaceId' --output text)",
              {"SecurityGroups":  {"Fn::Join": [" ", {"Ref": "SecondaryNICSecurityGroupIds"}]} }
            ]},
            "echo ENI ID: ${ENI_ID}",
            "aws ec2 create-tags --resources ${!ENI_ID} --tags Key=Some,Value=Tag",
            "ATTACHMENT_ID=$(aws ec2 attach-network-interface --network-interface-id ${ENI_ID} --instance-id ${INSTANCE_ID} --device-index 1 --output text)",
            "echo Attachment ID: ${ATTACHMENT_ID}",
            "echo Delete On Termination: $(aws ec2 modify-network-interface-attribute --network-interface-id ${ENI_ID} --attachment AttachmentId=${ATTACHMENT_ID},DeleteOnTermination=true --output text)"
           ]
        ]
      }
    }

如果您不想將子網傳遞到Cloud Formation模板，您可以嘗試通過在awscli describe-subnets調用中向--query添加標簽來查找它們，如果您的基礎結構允許您以這種方式識別它們。