如何在CloudFormation模板中爲Elastic Beanstalk啓動配置指定安全組？

我在CloudFormation模板中定義的下列安全組：如何在CloudFormation模板中爲Elastic Beanstalk啓動配置指定安全組？

"APIInstanceSG": { 
    "Type": "AWS::EC2::SecurityGroup", 
    "Properties": { 
    "GroupDescription": "Security Group for Application EC2 Instances, 
    "VpcId": "vpc-10a75377", 
    "Tags": [{ 
     "Key": "Name", 
     "Value": "APIInstanceSG" } 
    }] 
    } 
}

我也有定義包含以下內OptionSettings的彈性魔豆環境：

{ 
    "Namespace": "aws:autoscaling:launchconfiguration", 
    "OptionName": "SecurityGroups", 
    "Value": { "Ref": "APIInstanceSG" } 
}

當我使用這個模板創建堆棧，則在CloudFormation嘗試創建EB環境之前創建安全組，但在嘗試創建EB環境時，安全組會失敗並顯示以下錯誤：

Configuration validation exception: Invalid option value: 'sg-994fcbe4' (Namespace: 'aws:autoscaling:launchconfiguration', OptionName: 'SecurityGroups'): The security group 'sg-994fcbe4' does not exist

SG-994fcbe4是所創建的安全組的ID

彈性豆莖環境配置如下：

"AspectAPIEnv": { 
    "Type": "AWS::ElasticBeanstalk::Environment", 
    "Properties": { 
    "ApplicationName": "application-name", 
    "EnvironmentName": "environment-name", 
    "SolutionStackName": "64bit Amazon Linux 2016.09 v3.1.0 running Node.js", 
    "Tier": { 
     "Name": "WebServer", 
     "Type": "Standard" 
    }, 
    "OptionSettings": [ 
     { 
     "Namespace": "aws:autoscaling:launchconfiguration", 
     "OptionName": "EC2KeyName", 
     "Value": "ec2-key" 
     }, 
     { 
     "Namespace": "aws:autoscaling:launchconfiguration", 
     "OptionName": "IamInstanceProfile", 
     "Value": "aws-elasticbeanstalk-ec2-role" 
     }, 
     { 
     "Namespace": "aws:autoscaling:launchconfiguration", 
     "OptionName": "ImageId", 
     "Value": "ami-d8356acf" 
     }, 
     { 
     "Namespace": "aws:autoscaling:launchconfiguration", 
     "OptionName": "InstanceType", 
     "Value": "t2.micro" 
     }, 
     { 
     "Namespace": "aws:autoscaling:launchconfiguration", 
     "OptionName": "SecurityGroups", 
     "Value": { "Ref": "APIInstanceSG" } 
     }, 
     { 
     "Namespace": "aws:autoscaling:trigger", 
     "OptionName": "UpperThreshold", 
     "Value": "6000000" 
     }, 
     { 
     "Namespace": "aws:autoscaling:updatepolicy:rollingupdate", 
     "OptionName": "MaxBatchSize", 
     "Value": "1" 
     }, 
     { 
     "Namespace": "aws:autoscaling:updatepolicy:rollingupdate", 
     "OptionName": "MinInstancesInService", 
     "Value": "1" 
     }, 
     { 
     "Namespace": "aws:autoscaling:updatepolicy:rollingupdate", 
     "OptionName": "RollingUpdateEnabled", 
     "Value": "true" 
     }, 
     { 
     "Namespace": "aws:autoscaling:updatepolicy:rollingupdate", 
     "OptionName": "RollingUpdateType", 
     "Value": "Health" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:command", 
     "OptionName": "BatchSize", 
     "Value": "30" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:container:nodejs", 
     "OptionName": "NodeVersion", 
     "Value": "6.2.2" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:environment", 
     "OptionName": "ServiceRole", 
     "Value": "aws-elasticbeanstalk-service-role" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:healthreporting:system", 
     "OptionName": "SystemType", 
     "Value": "enhanced" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:managedactions", 
     "OptionName": "ManagedActionsEnabled", 
     "Value": "true" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:managedactions", 
     "OptionName": "PreferredStartTime", 
     "Value": "SUN:09:02" 
     }, 
     { 
     "Namespace": "aws:elasticbeanstalk:managedactions:platformupdate", 
     "OptionName": "UpdateLevel", 
     "Value": "minor" 
     }, 
     { 
     "Namespace": "aws:elb:healthcheck", 
     "OptionName": "Interval", 
     "Value": "10" 
     }, 
     { 
     "Namespace": "aws:elb:loadbalancer", 
     "OptionName": "CrossZone", 
     "Value": "true" 
     }, 
     { 
     "Namespace": "aws:elb:loadbalancer", 
     "OptionName": "LoadBalancerHTTPPort", 
     "Value": "80" 
     }, 
     { 
     "Namespace": "aws:elb:loadbalancer", 
     "OptionName": "SecurityGroups", 
     "Value": { "Ref": "APILoadBalancerSG" } 
     }, 
     { 
     "Namespace": "aws:elb:loadbalancer", 
     "OptionName": "ManagedSecurityGroup", 
     "Value": { "Ref": "APILoadBalancerSG" } 
     }, 
     { 
     "Namespace": "aws:elb:policies", 
     "OptionName": "ConnectionDrainingEnabled", 
     "Value": "true" 
     } 
    ], 
    "Tags": [ 
     { 
     "Key": "Name", 
     "Value": "AspectAPIEnv" 
     } 
    ] 
    }, 
    "DependsOn": "RDSInstance" 
}

來源

2016-11-18 bean

您認爲啓動配置與安全組位於同一個VPC中嗎？ –

是的，所有實例都在VPC內 – bean

您是否可以向我們展示您的Beanstalk環境資源的模板片段？ – rbarni

looki後在您的AWS :: ElasticBeanstalk :: Environment資源中，我能夠重現您遇到的錯誤。正如Marc Young在對您的問題發表評論時所建議的那樣，您沒有爲您的環境指定VPC。由於您的安全組位於VPC中，因此無法從不在同一VPC中的資源訪問。如果指定VPC

{ 
    "Namespace" : "aws:ec2:vpc", 
    "OptionName" : "VPCId", 
    "Value" : "vpc-10a75377" 
},

，創造與更新的模板棧將失敗，錯誤消息說你還需要：

爲了解決這個問題，必須在以下配置選項添加到您的環境指定環境子網，所以你需要添加下列選項：

{ 
    "Namespace" : "aws:ec2:vpc", 
    "OptionName" : "Subnets", 
    "Value" : <insert the subnet for your instances here> 
}, 
{ 
    "Namespace" : "aws:ec2:vpc", 
    "OptionName" : "ELBSubnets", 
    "Value" : <insert the subnet for your load balancer here> 
}

可以在Elastic Beanstalk CloudFormation sample templates檢查VPC的一個魔豆應用程序的工作示例。

來源

2016-11-23 13:18:47 rbarni

爲了克服這一：

You need to change the EB Security Group from AWS CLI, you cannot do it from AWS Web Console.

考慮您已經使用AWS CLI installed，您將需要執行此命令if要更改安全組：

aws elasticbeanstalk update-environment –environment-name –option-settings Namespace=aws:autoscaling:launchconfiguration,OptionName=SecurityGroups,Value=」」

Source

來源

2016-11-20 07:20:40 Ibrahim

我需要能夠做到這一點，作爲雲構建模板的一部分 – bean

你應該設置你的LC定義DependsOn屬性，以確保其堆棧創建過程中SG之前就存在。否則，您無法保證參考文件可以正常工作。

"APIInstanceSG": { 
    "Type": "AWS::EC2::SecurityGroup", 
    "Properties": { 
    "GroupDescription": "Security Group for Application EC2 Instances, 
    "VpcId": "vpc-10a75377", 
    "Tags": [{ 
     "Key": "Name", 
     "Value": "APIInstanceSG" } 
    }] 
    }, 
    "DependsOn" : "APIInstanceSG" 
}

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html

來源

2016-11-22 12:41:57 NHol

在你的模板，而不是

"DependsOn" : "RDSInstance"

寫：

"DependsOn": ["APIInstanceSG", "RDSInstance"]

來源

2016-11-23 11:09:05 Daniel777

如何在CloudFormation模板中爲Elastic Beanstalk啓動配置指定安全組？

回答

相關問題