如何在 AWS CloudFormation 模板中為新的 SecurityGroup 使用現有 VPC

Question

我正在嘗試 EC2 實例（新）、安全組（新）和 VPC（現有）。 這是我的 cloudformation 模板。

當我在 Stack 中運行模板時，出現錯誤，因為*"Value () for parameter groupId is invalid. The value cannot be empty"* 。 如何解決這個問題？

模板：

Parameters:
  VPCID:
    Description: Name of an existing VPC
    Type: AWS::EC2::VPC::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - t2.large
  AccessLocation:
    Description: The IP address range that can be used to access to the EC2 instances
    Type: String
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref 'InstanceType'
      SecurityGroups:
        - !Ref 'InstanceSecurityGroup'
      KeyName: !Ref 'KeyName'
      ImageId: !Ref 'ImageId'   
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCID
      GroupDescription: Enable SSH 
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref 'AccessLocation'

Answer 1

SecurityGroups只能用於默認 VPC 。 由於您將VPCID顯式分配給InstanceSecurityGroup ，因此這將被視為非默認值，從而導致部署失敗。

您必須在您的情況下使用SecurityGroupIds （不是SecurityGroups ），因為您的 VPC 使用將被視為非默認：

      SecurityGroupIds:
        - !GetAtt 'InstanceSecurityGroup.GroupId'  

Answer 2

SecurityGroups屬性中的EC2Instance資源中的錯誤。 SecurityGroups需要一個GroupId數組，但是當您使用!Ref InstanceSecurityGroup這將返回ResourceId 。 因此，您需要使用GetAtt來獲取GroupId 。

Parameters:
  VPCID:
    Description: Name of an existing VPC
    Type: AWS::EC2::VPC::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - t2.large
  AccessLocation:
    Description: The IP address range that can be used to access to the EC2 instances
    Type: String
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref 'InstanceType'
      SecurityGroups:
        - !GetAtt InstanceSecurityGroup.GroupId
      KeyName: !Ref 'KeyName'
      ImageId: !Ref 'ImageId'   
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCID
      GroupDescription: Enable SSH 
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref 'AccessLocation'

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html