無法向 ECS 集群注冊 ec2 實例

Question

錯誤：

service was unable to place a task because no container instance met all of its requirements. Reason: No Container Instances were found in your cluster

我看到資源列表已正確創建：

VPC, subnets, route tables, internet gateways, NatGW, EC2 instance, security groups, load balancer.

Ec2 實例已啟動並正在運行，但部署仍在進行中並超時，並回滾 state。

我還添加了信號腳本： /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region} /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}

不知道還缺少什么。

雲形成模板：

AWSTemplateFormatVersion: '2010-09-09'

Parameters:
  VPCEnv:
    Type: String
    MinLength: 1
    Description: 'The id for references to test Services created items.'

  Environment:
    Type: String
    Description: 'Environment to create backend infra for'

  KeyName:
    Type: String
    Description: 'Name of an existing EC2 KeyPair to enable SSH access to the ECS instances.'

  DesiredCapacity:
    Type: String
    Default: '1'
    Description: 'Number of instances to launch in your ECS cluster.'

  MaxSize:
    Type: String
    Default: '1'
    Description: Maximum number of instances that can be launched in your ECS cluster.

  InstanceType:
    Description: 'EC2 instance type'
    Type: String
    Default: 't2.medium'

  BackendContainerImage:
    Type: String
    MinLength: 1

  Version:
    Type: String
    MinLength: 1

  AMIID:
    Type: String
    MinLength: 1

Resources:
  ExecutionRole:
        Type: 'AWS::IAM::Role'
        Properties:
          AssumeRolePolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: 'Allow'
                Principal:
                  Service: ['ecs-tasks.amazonaws.com']
                Action: ['sts:AssumeRole']
          Policies:
            - PolicyName: !Sub test-${Environment}-execution-user-role
              PolicyDocument:
                Version: '2012-10-17'
                Statement:
                  - Effect: 'Allow'
                    Action: ['ecs:CreateCluster', 'ecs:DeregisterContainerInstance', 'ecs:DiscoverPollEndpoint',
                            'ecs:Poll', 'ecs:RegisterContainerInstance', 'ecs:StartTelemetrySession',
                            'ecs:UpdateContainerInstancesState', 'ecs:Submit*', 'ecr:GetAuthorizationToken',
                            'ecr:BatchCheckLayerAvailability', 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage',
                            'logs:CreateLogStream', 'logs:PutLogEvents', 'ssm:GetParameter', 'kms:Decrypt', 'ssm:GetParameters']
                    Resource: '*'

  ECSCluster:
    Type: AWS::ECS::Cluster

  EcsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ECS Security Group
      VpcId:
        Fn::ImportValue: !Sub "${VPCEnv}-VPC"
      SecurityGroupIngress:
        -
          IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          SourceSecurityGroupId:
            Fn::ImportValue: !Sub "${VPCEnv}-BastionSecurityGroup"
        -
          IpProtocol: tcp
          FromPort: '31000'
          ToPort: '61000'
          SourceSecurityGroupId: !Ref LoadBalancerSecurityGroup

  LoadBalancerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "test-${Environment}-LBSecurityGroup"
      GroupDescription:  test service Load Balancer Security Group
      VpcId:
        Fn::ImportValue: !Sub "${VPCEnv}-VPC"
      SecurityGroupIngress:
        -
          IpProtocol: tcp
          FromPort: '80'
          ToPort: '80'
          SourceSecurityGroupId:
            Fn::ImportValue: !Sub "${VPCEnv}-APILoadBalancerSecurityGroup"

  testServiceTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub 'test-${Environment}'
      ExecutionRoleArn: !Ref ExecutionRole
      ContainerDefinitions:
      - Name: !Sub 'test-${Environment}-container'
        Cpu: 600
        Essential: 'true'
        Image: !Ref BackendContainerImage
        Memory: 1800
        PortMappings:
          - ContainerPort: 3000

  ECSALBDNS:
    Type: "AWS::Route53::RecordSet"
    Properties:
      AliasTarget:
        DNSName: !GetAtt [ ECSALB, DNSName ]
        HostedZoneId: !GetAtt [ ECSALB, CanonicalHostedZoneID ]
      Comment: Internal DNS entry for audit service load balancer.
      HostedZoneId: Z03303053NOQR6YO05FA7
      Name: !Sub "api.internal.audit.service.${Environment}.altusplatform.com."
      Type: A

  ECSALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub "test-${Environment}-lb"
      Scheme: internal
      LoadBalancerAttributes:
      - Key: idle_timeout.timeout_seconds
        Value: '20'
      Subnets:
        Fn::Split:
          - ','
          - Fn::ImportValue: !Sub "${VPCEnv}-PrivateSubnets2"
      SecurityGroups:
        - !Ref LoadBalancerSecurityGroup
        - Fn::ImportValue : !Sub "${VPCEnv}-APILoadBalancerSecurityGroup"

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    DependsOn: ECSServiceRole
    Properties:
      DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref 'ECSTG'
      LoadBalancerArn: !Ref 'ECSALB'
      Port: '80'
      Protocol: HTTP

  ECSALBListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    DependsOn: ALBListener
    Properties:
      Actions:
      - Type: forward
        TargetGroupArn: !Ref 'ECSTG'
      Conditions:
      - Field: path-pattern
        Values: [/]
      ListenerArn: !Ref 'ALBListener'
      Priority: 1

  ECSTG:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    DependsOn: ECSALB
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /health
      HealthCheckProtocol: HTTP
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      Name: !Sub "test-${Environment}-tg"
      Port: 80
      Protocol: HTTP
      UnhealthyThresholdCount: 2
      VpcId:
        Fn::ImportValue: !Sub "${VPCEnv}-VPC"

  ECSAutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        Fn::Split:
          - ','
          - Fn::ImportValue: !Sub "${VPCEnv}-PrivateSubnets2"
      LaunchConfigurationName: !Ref 'ContainerInstances'
      MinSize: '1'
      MaxSize: !Ref 'MaxSize'
      DesiredCapacity: !Ref 'DesiredCapacity'

  ContainerInstances:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      ImageId: !Sub '${AMIID}'
      SecurityGroups: [!Ref 'EcsSecurityGroup']
      InstanceType: !Ref 'InstanceType'
      IamInstanceProfile: !Ref 'EC2InstanceProfile'
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          yum update -y
          echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
          yum install -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource ECSAutoScalingGroup --region ${AWS::Region}
          yum install -y awslogs jq
          region=$(curl -s 169.254.169.254/latest/dynamic/instance-identity/document | jq -r .region)
          sed -i -e "s/region = us-east-1/region = $region/g" /etc/awslogs/awscli.conf
          yum install -y https://amazon-ssm-$region.s3.amazonaws.com/latest/linux_amd64/amazon-ssm-agent.rpm

  service:
    Type: AWS::ECS::Service
    DependsOn: ALBListener
    Properties:
      Cluster: !Ref 'ECSCluster'
      DesiredCount: '2'
      LoadBalancers:
      - ContainerName: !Sub 'test-${Environment}-container'
        ContainerPort: 3000
        TargetGroupArn: !Ref 'ECSTG'
      Role: !Ref 'ECSServiceRole'
      TaskDefinition: !Ref 'testServiceTaskDefinition'
      DeploymentConfiguration:
        MaximumPercent: 150
        MinimumHealthyPercent: 50

  ECSServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ecs.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: ecs-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: ['elasticloadbalancing:DeregisterInstancesFromLoadBalancer', 'elasticloadbalancing:DeregisterTargets',
              'elasticloadbalancing:Describe*', 'elasticloadbalancing:RegisterInstancesWithLoadBalancer',
              'elasticloadbalancing:RegisterTargets', 'ec2:Describe*', 'ec2:AuthorizeSecurityGroupIngress']
            Resource: '*'

  ServiceScalingTarget:
    Type: AWS::ApplicationAutoScaling::ScalableTarget
    DependsOn: service
    Properties:
      MaxCapacity: 1
      MinCapacity: 1
      ResourceId: !Join ['', [service/, !Ref 'ECSCluster', /, !GetAtt [service, Name]]]
      RoleARN: !GetAtt [AutoscalingRole, Arn]
      ScalableDimension: ecs:service:DesiredCount
      ServiceNamespace: ecs

  ServiceScalingPolicy:
    Type: AWS::ApplicationAutoScaling::ScalingPolicy
    Properties:
      PolicyName: AStepPolicy
      PolicyType: StepScaling
      ScalingTargetId: !Ref 'ServiceScalingTarget'
      StepScalingPolicyConfiguration:
        AdjustmentType: PercentChangeInCapacity
        Cooldown: 60
        MetricAggregationType: Average
        StepAdjustments:
        - MetricIntervalLowerBound: 0
          ScalingAdjustment: 200

  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [ec2.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: ecs-service
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: ['ecs:CreateCluster', 'ecs:DeregisterContainerInstance', 'ecs:DiscoverPollEndpoint',
              'ecs:Poll', 'ecs:RegisterContainerInstance', 'ecs:StartTelemetrySession', 'ecs:UpdateContainerInstancesState',
              'ecs:Submit*', 'ecr:GetAuthorizationToken', 'ecr:BatchCheckLayerAvailability', 'ecr:GetDownloadUrlForLayer', 'ecr:BatchGetImage',
              'logs:CreateLogStream', 'logs:PutLogEvents']
            Resource: '*'

  AutoscalingRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Effect: Allow
          Principal:
            Service: [application-autoscaling.amazonaws.com]
          Action: ['sts:AssumeRole']
      Path: /
      Policies:
      - PolicyName: service-autoscaling
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action: ['application-autoscaling:*', 'cloudwatch:DescribeAlarms', 'cloudwatch:PutMetricAlarm',
              'ecs:DescribeServices', 'ecs:UpdateService']
            Resource: '*'

  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']

Outputs:
  ecsservice:
    Value: !Ref 'service'
  ecscluster:
    Value: !Ref 'ECSCluster'
  ECSALB:
    Description: Your ALB DNS URL
    Value: !Join ['', [!GetAtt [ECSALB, DNSName]]]
  taskdef:
    Value: !Ref 'testServiceTaskDefinition'

導出的值：

Answer 1

我在使用 ECS 集群配置自動縮放時遇到了上述問題。 為了使自動擴展能夠正確地將它創建的實例報告回 ECS 集群，需要創建一個自動擴展組容量提供程序：

Type: AWS::ECS::CapacityProvider
Properties: 
  AutoScalingGroupProvider: 
    AutoScalingGroupProvider
  Name: String
  Tags: 
    - Tag

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/asg-capacity-providers.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ecs-capacityprovider.html