在CloudFormation中创建ALB目标组

Question

我正尝试在CloudFormation中创建应用程序负载平衡器，并将目标组转发到EC2实例。下面是相关片段，其中的ELBSubnets，ECSCluster，taskdefinition和VpcId被作为参数传入：

"EcsElasticLoadBalancer" : { 
    "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", 
    "Properties" : { 
    "Subnets" : { "Ref" : "ELBSubnets" }, 
    "SecurityGroups": [ 
     { "Ref": "ELBAccessSecurityGroup" } 
    ] 
    } 
}, 
"LoadBalancerListener": { 
    "Type": "AWS::ElasticLoadBalancingV2::Listener", 
    "Properties": { 
    "DefaultActions": [{ 
     "Type": "forward", 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
    }], 
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, 
    "Port": 80, 
    "Protocol": "HTTP" 
    } 
}, 
"TargetGroup": { 
    "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", 
    "Properties": { 
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, 
    "Port": 80, 
    "Protocol": "HTTP", 
    "VpcId": { "Ref": "VpcId" } 
    }, 
    "DependsOn": [ "EcsElasticLoadBalancer" ] 
}, 
"service": { 
    "Type": "AWS::ECS::Service", 
    "Properties" : { 
    "Cluster": { "Ref": "ECSCluster" }, 
    "DesiredCount": "1", 
    "LoadBalancers": [ 
     { 
     "ContainerName": "main-app", 
     "ContainerPort": 3000, 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
     } 
    ], 
    "Role" : {"Ref":"ECSServiceRole"}, 
    "TaskDefinition" : {"Ref":"taskdefinition"} 
    } 
}, 
"ECSServiceRole": { 
    "Type": "AWS::IAM::Role", 
    "Properties": { 
    "AssumeRolePolicyDocument": { 
     "Statement": [ 
     { 
      "Effect": "Allow", 
      "Principal": { 
      "Service": [ 
       "ecs.amazonaws.com" 
      ] 
      }, 
      "Action": [ 
      "sts:AssumeRole" 
      ] 
     } 
     ] 
    }, 
    "Path": "/", 
    "Policies": [ 
     { 
     "PolicyName": "ecs-service", 
     "PolicyDocument": { 
      "Statement": [ 
      { 
       "Effect": "Allow", 
       "Action": [ 
       "elasticloadbalancing:Describe*", 
       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", 
       "elasticloadbalancing:RegisterInstancesWithLoadBalancer", 
       "ec2:Describe*", 
       "ec2:AuthorizeSecurityGroupIngress" 
       ], 
       "Resource": "*" 
      } 
      ] 
     } 
     } 
    ] 
    } 
} 

创建服务时，我得到了以下错误：

的目标群体与targetGroupArn阿尔恩：aws：elasticloadbalancing：us-east-1：xxxxxxxx：targetgroup/AlbServiceStack-TargetGroup/6ba9c037c26cdb36没有关联的负载均衡器。

我错过了什么？在文档中似乎没有为目标组指定负载平衡器的方法。

Answer 1

得到它的工作 - 问题是双重的：

• "elasticloadbalancing:DeregisterTargets"
• "elasticloadbalancing:RegisterTargets"

服务所需"DependsOn": [ "LoadBalancerListener" ]为：

1. 下面的几行是从角色PolicyDocument失踪一个额外的属性。

更新的模板看起来是这样的：

"EcsElasticLoadBalancer" : { 
    "Type" : "AWS::ElasticLoadBalancingV2::LoadBalancer", 
    "Properties" : { 
    "Subnets" : { "Ref" : "ELBSubnets" }, 
    "SecurityGroups": [ 
     { "Ref": "ELBAccessSecurityGroup" } 
    ] 
    } 
}, 
"LoadBalancerListener": { 
    "Type": "AWS::ElasticLoadBalancingV2::Listener", 
    "Properties": { 
    "DefaultActions": [{ 
     "Type": "forward", 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
    }], 
    "LoadBalancerArn": { "Ref": "EcsElasticLoadBalancer" }, 
    "Port": 80, 
    "Protocol": "HTTP" 
    } 
}, 
"TargetGroup": { 
    "Type": "AWS::ElasticLoadBalancingV2::TargetGroup", 
    "Properties": { 
    "Name": { "Fn::Join": [ "-", [ { "Ref": "AWS::StackName" }, "TargetGroup" ] ] }, 
    "Port": 80, 
    "Protocol": "HTTP", 
    "VpcId": { "Ref": "VpcId" } 
    }, 
    "DependsOn": [ "EcsElasticLoadBalancer" ] 
}, 
"service": { 
    "Type": "AWS::ECS::Service", 
    "DependsOn": [ "LoadBalancerListener" ], 
    "Properties" : { 
    "Cluster": { "Ref": "ECSCluster" }, 
    "DesiredCount": "1", 
    "LoadBalancers": [ 
     { 
     "ContainerName": "main-app", 
     "ContainerPort": 3000, 
     "TargetGroupArn": { "Ref": "TargetGroup" } 
     } 
    ], 
    "Role" : {"Ref":"ECSServiceRole"}, 
    "TaskDefinition" : {"Ref":"taskdefinition"} 
    } 
}, 
"ECSServiceRole": { 
    "Type": "AWS::IAM::Role", 
    "Properties": { 
    "AssumeRolePolicyDocument": { 
     "Statement": [ 
     { 
      "Effect": "Allow", 
      "Principal": { 
      "Service": [ 
       "ecs.amazonaws.com" 
      ] 
      }, 
      "Action": [ 
      "sts:AssumeRole" 
      ] 
     } 
     ] 
    }, 
    "Path": "/", 
    "Policies": [ 
     { 
     "PolicyName": "ecs-service", 
     "PolicyDocument": { 
      "Statement": [ 
      { 
       "Effect": "Allow", 
       "Action": [ 
       "elasticloadbalancing:Describe*", 
       "elasticloadbalancing:DeregisterInstancesFromLoadBalancer", 
       "elasticloadbalancing:RegisterInstancesWithLoadBalancer", 
       "ec2:Describe*", 
       "ec2:AuthorizeSecurityGroupIngress", 
       "elasticloadbalancing:DeregisterTargets", 
       "elasticloadbalancing:RegisterTargets" 
       ], 
       "Resource": "*" 
      } 
      ] 
     } 
     } 
    ] 
    } 
}