在CloudFormation中創建ALB目標組

Question

我正嘗試在CloudFormation中創建應用程序負載平衡器，並將目標組轉發到EC2實例。下面是相關片段，其中的ELBSubnets，ECSCluster，taskdefinition和VpcId被作爲參數傳入：

"EcsElasticLoadBalancer" : { 
    "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", 
    "Properties" : { 
    "Subnets" : { "Ref" : "ELBSubnets" }, 
    "SecurityGroups": [ 
     { "Ref": "ELBAccessSecurityGroup" } 
    ] 
    } 
}, 
"LoadBalancerListener": { 
    "Type": "AWS::ElasticLoadBalancingV2::Listener", 
    "Properties": { 
    "DefaultActions": [{ 
     "Type": "forward", 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
    }], 
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, 
    "Port": 80, 
    "Protocol": "HTTP" 
    } 
}, 
"TargetGroup": { 
    "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", 
    "Properties": { 
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, 
    "Port": 80, 
    "Protocol": "HTTP", 
    "VpcId": { "Ref": "VpcId" } 
    }, 
    "DependsOn": [ "EcsElasticLoadBalancer" ] 
}, 
"service": { 
    "Type": "AWS::ECS::Service", 
    "Properties" : { 
    "Cluster": { "Ref": "ECSCluster" }, 
    "DesiredCount": "1", 
    "LoadBalancers": [ 
     { 
     "ContainerName": "main-app", 
     "ContainerPort": 3000, 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
     } 
    ], 
    "Role" : {"Ref":"ECSServiceRole"}, 
    "TaskDefinition" : {"Ref":"taskdefinition"} 
    } 
}, 
"ECSServiceRole": { 
    "Type": "AWS::IAM::Role", 
    "Properties": { 
    "AssumeRolePolicyDocument": { 
     "Statement": [ 
     { 
      "Effect": "Allow", 
      "Principal": { 
      "Service": [ 
       "ecs.amazonaws.com" 
      ] 
      }, 
      "Action": [ 
      "sts:AssumeRole" 
      ] 
     } 
     ] 
    }, 
    "Path": "/", 
    "Policies": [ 
     { 
     "PolicyName": "ecs-service", 
     "PolicyDocument": { 
      "Statement": [ 
      { 
       "Effect": "Allow", 
       "Action": [ 
       "elasticloadbalancing:Describe*", 
       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", 
       "elasticloadbalancing:RegisterInstancesWithLoadBalancer", 
       "ec2:Describe*", 
       "ec2:AuthorizeSecurityGroupIngress" 
       ], 
       "Resource": "*" 
      } 
      ] 
     } 
     } 
    ] 
    } 
} 

創建服務時，我得到了以下錯誤：

的目標羣體與targetGroupArn阿爾恩：aws：elasticloadbalancing：us-east-1：xxxxxxxx：targetgroup/AlbServiceStack-TargetGroup/6ba9c037c26cdb36沒有關聯的負載均衡器。

我錯過了什麼？在文檔中似乎沒有爲目標組指定負載平衡器的方法。

Answer 1

得到它的工作 - 問題是雙重的：

• "elasticloadbalancing:DeregisterTargets"
• "elasticloadbalancing:RegisterTargets"

服務所需"DependsOn": [ "LoadBalancerListener" ]爲：

1. 下面的幾行是從角色PolicyDocument失蹤一個額外的屬性。

更新的模板看起來是這樣的：

"EcsElasticLoadBalancer" : { 
    "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", 
    "Properties" : { 
    "Subnets" : { "Ref" : "ELBSubnets" }, 
    "SecurityGroups": [ 
     { "Ref": "ELBAccessSecurityGroup" } 
    ] 
    } 
}, 
"LoadBalancerListener": { 
    "Type": "AWS::ElasticLoadBalancingV2::Listener", 
    "Properties": { 
    "DefaultActions": [{ 
     "Type": "forward", 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
    }], 
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, 
    "Port": 80, 
    "Protocol": "HTTP" 
    } 
}, 
"TargetGroup": { 
    "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", 
    "Properties": { 
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, 
    "Port": 80, 
    "Protocol": "HTTP", 
    "VpcId": { "Ref": "VpcId" } 
    }, 
    "DependsOn": [ "EcsElasticLoadBalancer" ] 
}, 
"service": { 
    "Type": "AWS::ECS::Service", 
    "DependsOn": [ "LoadBalancerListener" ], 
    "Properties" : { 
    "Cluster": { "Ref": "ECSCluster" }, 
    "DesiredCount": "1", 
    "LoadBalancers": [ 
     { 
     "ContainerName": "main-app", 
     "ContainerPort": 3000, 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
     } 
    ], 
    "Role" : {"Ref":"ECSServiceRole"}, 
    "TaskDefinition" : {"Ref":"taskdefinition"} 
    } 
}, 
"ECSServiceRole": { 
    "Type": "AWS::IAM::Role", 
    "Properties": { 
    "AssumeRolePolicyDocument": { 
     "Statement": [ 
     { 
      "Effect": "Allow", 
      "Principal": { 
      "Service": [ 
       "ecs.amazonaws.com" 
      ] 
      }, 
      "Action": [ 
      "sts:AssumeRole" 
      ] 
     } 
     ] 
    }, 
    "Path": "/", 
    "Policies": [ 
     { 
     "PolicyName": "ecs-service", 
     "PolicyDocument": { 
      "Statement": [ 
      { 
       "Effect": "Allow", 
       "Action": [ 
       "elasticloadbalancing:Describe*", 
       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", 
       "elasticloadbalancing:RegisterInstancesWithLoadBalancer", 
       "ec2:Describe*", 
       "ec2:AuthorizeSecurityGroupIngress", 
       "elasticloadbalancing:DeregisterTargets", 
       "elasticloadbalancing:RegisterTargets" 
       ], 
       "Resource": "*" 
      } 
      ] 
     } 
     } 
    ] 
    } 
}