不能在ECS實例

我有這樣的UserData在configurationConfig資源在我cloudformation模板安裝EFS：不能在ECS實例

"UserData":{ "Fn::Base64" : { 
      "Fn::Join" : ["", [ 
       "#!/bin/bash -xv\n", 
       "yum -y update\n", 
       "yum -y install aws-cfn-bootstrap\n", 
       "yum -y install awslogs jq\n", 
       "#Install NFS client\n", 
       "yum -y install nfs-utils\n", 
       "#Install pip\n", 
       "yum -y install python27 python27-pip\n", 
       "#Install awscli\n", 
       "pip install awscli\n", 
       "#Upgrade to the latest version of the awscli\n", 
       "#pip install --upgrade awscli\n", 
       "#Add support for EFS to the CLI configuration\n", 
       "aws configure set preview.efs true\n", 
       "#Get region of EC2 from instance metadata\n", 
       "EC2_AVAIL_ZONE=`curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone`\n", 
       "EC2_REGION=",{ "Ref": "AWS::Region"} ,"\n", 
       "mkdir /efs-tmp/\n", 
       "chown -R ec2-user:ec2-user /efs-tmp/\n", 
       "DIR_SRC=$EC2_AVAIL_ZONE.",{ "Fn::FindInMap" : [ "FileSystemMap", {"Ref" : "EnvParam"}, "FileSystemID"] },".efs.$EC2_REGION.amazonaws.com\n", 
       "DIR_TGT=/efs-tmp/\n", 
       "touch /home/ec2-user/echo.res\n", 
       "echo ",{ "Fn::FindInMap" : [ "FileSystemMap", {"Ref" : "EnvParam"}, "FileSystemID"] }," >> /home/ec2-user/echo.res\n", 
       "echo $EC2_AVAIL_ZONE >> /home/ec2-user/echo.res\n", 
       "echo $EC2_REGION >> /home/ec2-user/echo.res\n", 
       "echo $DIR_SRC >> /home/ec2-user/echo.res\n", 
       "echo $DIR_TGT >> /home/ec2-user/echo.res\n", 
       "#Mount EFS file system\n", 
       "mount -t nfs4 -o vers=4.1 $DIR_SRC:/ $DIR_TGT >> /home/ec2-user/echo.res\n", 
       "#Backup fstab\n", 
       "cp -p /etc/fstab /etc/fstab.back-$(date +%F)\n", 
       "echo -e \"$DIR_SRC:/ $DIR_TGT nfs4 nfsvers=4.1 0 0 | tee -a /etc/fstab\n", 
         "docker ps\n", 
       "service docker stop\n", 
       "service docker start\n", 
       "/opt/aws/bin/cfn-init -v", 
       "   --stack ", { "Ref": "AWS::StackName" }, 
       "   --resource ContainerInstances", 
       "   --region ", { "Ref" : "AWS::Region" },"\n", 
       "service awslogs start\n", 
       "chkconfig awslogs on\n" 
      ]]}

這裏是安全組ECS容器：

"EcsSecurityGroup":{ 
    "Type" : "AWS::EC2::SecurityGroup", 
    "Properties" : { 
     "GroupDescription" : "ECS SecurityGroup", 
     "SecurityGroupIngress" : [ 
     { 
      "IpProtocol" : "tcp", 
      "FromPort" : "2049", 
      "ToPort" : "2049", 
      "CidrIp" : {"Ref" : "CIDRVPC"} 
     }, 
     { 
      "IpProtocol" : "tcp", 
      "FromPort" : "22", 
      "ToPort" : "22", 
      "CidrIp" : "0.0.0.0/0" 
     } 
     ], 
     "SecurityGroupEgress" : [ 
     { 
      "IpProtocol" : "-1", 
      "FromPort" : "-1", 
      "ToPort" : "-1", 
      "CidrIp" : "0.0.0.0/0" 
     } 
     ], 
     "VpcId":{ "Ref":"VpcId" } 
    } 
    },

後運行模板，我ssh進入實例，等待userdata完成執行，然後我在/var/log/cloud-init-ouptut.log找到這個錯誤：

mount.nfs4: Connection timed out

而且，/etc/fstab文件不包含裝配線。而我無法訪問文件系統，因爲創建的EFS文件夾是空的。

請告訴我這裏的問題在哪裏？

來源

2017-02-21 Somar

確保您創建EFS安全組，並允許在入口規則的EC2安全：

"EfsSecurityGroup": { 
     "Properties": { 
      "GroupDescription": "EFS security group", 
      "SecurityGroupIngress": [ 
       { 
        "FromPort": 2049, 
        "IpProtocol": "tcp", 
        "SourceSecurityGroupId": { 
         "Ref": "YOUR_EC2_SECURITY_GROUP" 
        }, 
        "ToPort": 2049 
       }, 
      ], 
      "Tags": [ 
       { 
        "Key": "Application", 
        "Value": { 
         "Ref": "AWS::StackName" 
        } 
       }, 
       { 
        "Key": "Name", 
        "Value": "efs-sg" 
       } 
      ], 
      "VpcId": { 
       "Ref": "YOUR_VPC_ID" 
      } 
     }, 
     "Type": "AWS::EC2::SecurityGroup" 
    }

確保EFS mountarget存在：

"EFSMountTargetYourAZ": { 
     "Properties": { 
      "FileSystemId": "EFS_id", 
      "SecurityGroups": [ 
       { 
        "Ref": "EFS_SECURITY_GROUP" 
       } 
      ], 
      "SubnetId": { 
       "Ref": "SUBNET_ID" 
      } 
     }, 
     "Type": "AWS::EFS::MountTarget" 
    },

來源

2017-02-21 16:50:35 Gigapalmer

在您的EC2安全組，你不應該具有用於EFS的端口2049的入口規則，則應該創建一個efs安全組，並將該ec2安全性作爲該端口2049上的SourceSecurityGroupId。 – Gigapalmer

有一個錯字在這條線在腳本中，（失蹤關閉\"）這是造成嘗試寫入到/etc/fstab失敗：

echo -e \"$DIR_SRC:/ $DIR_TGT nfs4 nfsvers=4.1 0 0 | tee -a /etc/fstab\n",

這應該閱讀：

echo -e \"$DIR_SRC:/ $DIR_TGT nfs4 nfsvers=4.1 0 0\" | tee -a /etc/fstab\n",

您需要確保指定的可用區中存在AWS::EFS::MountTarget資源。否則，嘗試使用DNS名稱安裝文件系統將無法正確解析。有關更多文檔，請參閱Mounting File Systems和AWS::EFS::FileSystem。

來源

2017-02-21 16:44:47 wjordan

不能在ECS實例

回答

相關問題