如何使用 CloudFormation 覆蓋容器環境變量運行 AWS ECS 任務

Question

我正在尋找一種運行 ecs 任務的方法。 我已經有了集群和任務定義設置。 我只是想使用 CloudFormation 模板觸發任務。 我知道我可以通過單擊控制台來運行任務並且它工作正常。 對於cfn，需要正確定義方法。

檢查隨附的屏幕截圖。 我想使用 CloudFormation 運行該任務並傳遞容器覆蓋環境變量。 根據我當前的模板，它不允許我像使用控制台那樣做同樣的事情。 使用控制台我只需要 select 以下選項

  1. Launch type 
  2. Task Definition 
              Family
              Revision 
  3. VPC and security groups 
  4. Environment variable overrides rest of the things automatically selected

它開始使用控制台，但使用 cloudformaton 模板我們怎么能做到這一點。 是否可以做或沒有這樣的功能？

      "taskdefinition": {
    "Type" : "AWS::ECS::TaskDefinition",
    "DependsOn": "DatabaseMaster",
    "Properties" : {
        "ContainerDefinitions" : [{
            "Environment" : [
              {
                 "Name" : "TARGET_DATABASE",
                 "Value" : {"Ref":"DBName"}
              },
              {
                 "Name" : "TARGET_HOST",
                 "Value" : {"Fn::GetAtt": ["DatabaseMaster", "Endpoint.Address"]}
              }
            ]
          }],
        "ExecutionRoleArn" : "arn:aws:iam::xxxxxxxxxx:role/ecsTaskExecutionRole",
        "Family" : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "TaskRoleArn" : "arn:aws:iam::xxxxxxxxxxxxxxx:role/xxxxxxxxxxxxxxx-XXXXXXXXX"
    }
  },
  "EcsService": {
    "Type" : "AWS::ECS::Service",
    "Properties" : {
        "Cluster" : "xxxxxxxxxxxxxxxxx",
        "LaunchType" : "FARGATE",
        "NetworkConfiguration" : {
               "AwsvpcConfiguration" : {
                      "SecurityGroups" : ["sg-xxxxxxxxxxx"],
                      "Subnets" : ["subnet-xxxxxxxxxxxxxx"]
                      }
           },
        "TaskDefinition" : "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
      }
  }

但是，代碼中沒有有效性錯誤，我正在談論這種方法。 我添加了圖像名稱容器名稱，但現在它要求 memory 和 cpu，它不應該問，因為它已經定義我們只需要運行一個任務。

已編輯

我想在創建數據庫后運行一項任務，並希望將這些數據庫值傳遞給任務以運行並完成一項工作。

Answer 1

對於 Fargate 任務，我們需要在任務定義的 CPU 中指定。 以及任務或容器定義中的 memory 或 memory 預留。

環境變量應作為 ContainerDefinitions 傳遞給每個容器，並在從控制台或 cli 的 ecs 任務運行中運行任務時覆蓋。

{
   "ContainerTaskdefinition": {
      "Type": "AWS::ECS::TaskDefinition",
      "Properties": {
         "Family": "SomeFamily",
         "ExecutionRoleArn": !Ref RoleArn,
         "TaskRoleArn": !Ref TaskRoleArn,
         "Cpu": "256",
         "Memory": "1GB",
         "NetworkMode": "awsvpc",
         "RequiresCompatibilities": [
            "EC2",
            "FARGATE"
         ],
         "ContainerDefinitions": [
            {
               "Name": "container name",
               "Cpu": 256,
               "Essential": "true",
               "Image": !Ref EcsImage,
               "Memory": "1024",
               "LogConfiguration": {
                  "LogDriver": "awslogs",
                  "Options": {
                     "awslogs-group": null,
                     "awslogs-region": null,
                     "awslogs-stream-prefix": "ecs"
                  }
               },
               "Environment": [
                  {
                     "Name": "ENV_ONE_KEY",
                     "Value": "Valu1"
                  },
                  {
                     "Name": "ENV_TWO_KEY",
                     "Value": "Valu2"
                  }
               ]
            }
         ]
      }
   }
}

編輯（來自評論中的討論）：ECS 任務運行不是雲形成資源，它只能從控制台或 CLI 運行。 但如果我們選擇從 cloudformation 資源運行，則可以使用 cloudformation 自定義資源來完成。 但是一旦任務結束，我們現在擁有 cloudformation 中的資源，而背后沒有實際資源。 所以，自定義資源需要做：

• 創建時：運行任務。
• 刪除時：什么都不做。
• 更新時：重新運行任務

每次我們需要運行任務時，通過更改屬性或邏輯 ID 來強制更新。

Answer 2

如果您想傳遞變量並運行任務，這是您可以做的工作示例。 就我而言，我想在創建數據庫后運行一個任務，但使用環境變量，直接 AWS 不提供任何功能來執行此操作，這是可以幫助觸發您的 ecs 任務的解決方案。

"IAMRole": {
    "Type": "AWS::IAM::Role",
    "Properties": {
      "AssumeRolePolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Service": [
                "events.amazonaws.com"
              ]
            },
            "Action": [
              "sts:AssumeRole"
            ]
          }
        ]
      },
      "Description": "Allow CloudWatch Events to trigger ECS task",
      "Policies": [
        {
          "PolicyName": "Allow-ECS-Access",
          "PolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
              {
                "Effect": "Allow",
                "Action": [
                  "ecs:*",
                  "iam:PassRole",
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
                ],
                "Resource": "*"
              }
            ]
          }
        }
      ],
      "RoleName": { "Fn::Join": [ "", ["CloudWatchTriggerECSRole-", { "Ref": "DBInstanceIdentifier" }]]}
    }
  },
  "DummyParameter": {
      "Type" : "AWS::SSM::Parameter",
      "Properties" : {
          "Name" : {"Fn::Sub": "${AWS::StackName}-${DatabaseMaster}-EndpointAddress"},
          "Type" : "String",
          "Value" : {"Fn::GetAtt": "DatabaseMaster.Endpoint.Address"}
      },
      "DependsOn": "TaskSchedule"
  },
  "TaskSchedule": {
    "Type": "AWS::Events::Rule",
    "Properties": {
      "Description": "Trigger ECS task upon creation of DB instance",
      "Name": { "Fn::Join": [ "", ["ECSTaskTrigger-", { "Ref": "DBName" }]]},
      "RoleArn": {"Fn::GetAtt": "IAMRole.Arn"},
      "EventPattern": {
          "source": [ "aws.ssm" ],
          "detail-type": ["Parameter Store Change"] ,
          "resources": [{"Fn::Sub":"arn:aws:ssm:eu-west-1:XXXXXXX:parameter/${AWS::StackName}-${DatabaseMaster}-EndpointAddress"}],
          "detail": {
              "operation": ["Create"],
              "name": [{"Fn::Sub": "${AWS::StackName}-${DatabaseMaster}-EndpointAddress"}],
              "type": ["String"]
          }
      },
      "State": "ENABLED",
      "Targets": [
        {
          "Arn": "arn:aws:ecs:eu-west-1:xxxxxxxx:cluster/NameOf-demo",
          "Id": "NameOf-demo",
          "RoleArn": {"Fn::GetAtt": "IAMRole.Arn"},
          "EcsParameters": {
            "LaunchType": "FARGATE",
            "NetworkConfiguration": {
              "AwsVpcConfiguration": {
                "SecurityGroups": {"Ref":"VPCSecurityGroups"},
                "Subnets": {"Ref":"DBSubnetName"}
              }
            },
            "PlatformVersion": "LATEST",
            "TaskDefinitionArn": "arn:aws:ecs:eu-west-1:XXXXXXXX:task-definition/NameXXXXXXXXX:1"
          },
          "Input": {"Fn::Sub": [
              "{\"containerOverrides\":[{\"name\":\"MyContainerName\",\"environment\":[{\"name\":\"VAR1\",\"value\":\"${TargetDatabase}\"},{\"name\":\"VAR2\",\"value\":\"${TargetHost}\"},{\"name\":\"VAR3\",\"value\":\"${TargetHostPassword}\"},{\"name\":\"VAR4\",\"value\":\"${TargetPort}\"},{\"name\":\"VAR5\",\"value\":\"${TargetUser}\"},{\"name\":\"VAR6\",\"value\":\"${TargetLocation}\"},{\"name\":\"VAR7\",\"value\":\"${TargetRegion}\"}]}]}",
              {
                  "VAR1":      {"Ref":"DBName"},
                  "VAR2":          {"Fn::GetAtt": ["DatabaseMaster", "Endpoint.Address"]},
                  "VAR3":  {"Ref":"DBPassword"},
                  "VAR4":          "5432",
                  "VAR5":          {"Ref":"DBUser"},
                  "VAR6":      "value6",
                  "VAR7":        "eu-west-2"
              }
          ]}
        }
      ]
    }
  }