AWS CloudFormation Internet网关出错

Question

CloudFormation初学者在这里。我一直在研究和开发一个CloudFormation模板，最终将被用作我的团队开发环境的起点。

我一直在网上搜索一些课程和实例，并在我的小试图中相对成功......直到今晚。

我现在试图将Internet网关连接到我的VPC，并导致堆栈创建作业失败并回滚。互联网网关不会附加，对我来说，我无法确定为什么。

我的完整模板在这里。计划是创建一个具有2个公共和2个私有子网的VPC。将有一个互联网网关连接到2个公共子网。这是故障发生的地方。如果我注释掉Internet网关的创建，则模板成功。在此先感谢您的帮助。

AWSTemplateFormatVersion: '2010-09-09' 

Resources: 
    DevVPC: 
    Type: AWS::EC2::VPC 
    Properties: 
     CidrBlock: 10.0.0.0/16 
     EnableDnsSupport: 'true' 
     EnableDnsHostnames: 'true' 
     InstanceTenancy: default 
    Tags: 
    - Key: Name 
    Value: dev-vpc 

    DevRoute53HostedZone: 
    Type: "AWS::Route53::HostedZone" 
    Properties: 
     HostedZoneConfig: 
     Comment: "aws hosted dev environment" 
     Name: "mydomain.oregon-dev.local" 
     VPCs: 
     - 
      VPCId: !Ref DevVPC 
      VPCRegion: "us-west-2" 

    DevPublicSubnetA: 
Type: AWS::EC2::Subnet 
Properties: 
    VpcId: !Ref DevVPC 
    CidrBlock: 10.0.8.0/25 
    AvailabilityZone: "us-west-2a" 
    Tags: 
    - Key: Name 
    Value: DevPublicSubnetA 

    DevPublicSubnetB: 
     Type: AWS::EC2::Subnet 
     Properties: 
     VpcId: !Ref DevVPC 
     CidrBlock: 10.0.8.128/25 
     AvailabilityZone: "us-west-2b" 
     Tags: 
     - Key: Name 
      Value: DevPublicSubnetB 

    DevPrivateSubnetA: 
    Type: AWS::EC2::Subnet 
    Properties: 
     VpcId: !Ref DevVPC 
     CidrBlock: 10.0.9.0/25 
     AvailabilityZone: "us-west-2a" 
     Tags: 
     - Key: Name 
     Value: DevPrivateSubnetA 

    DevPrivateSubnetB: 
    Type: AWS::EC2::Subnet 
    Properties: 
     VpcId: !Ref DevVPC 
     CidrBlock: 10.0.9.128/25 
     AvailabilityZone: "us-west-2b" 
     Tags: 
     - Key: Name 
     Value: DevPrivateSubnetB 

    RouteTable: 
    Type: AWS::EC2::RouteTable 
    Properties: 
     VpcId: 
     Ref: DevVPC 
     Tags: 
     - Key: Name 
     Value: DevRouteTable 

    DevRoute: 
    Type: AWS::EC2::Route 
    DependsOn: NonProdNATGateway 
    Properties: 
     RouteTableId: 
     Ref: RouteTable 
     DestinationCidrBlock: 0.0.0.0/0 
     GatewayId: 
     Ref: NonProdNATGateway 

    NonProdNATEIP: 
    Type: AWS::EC2::EIP 
    Properties: 
     Domain: vpc 

    NonProdNATGateway: 
    Type: AWS::EC2::NatGateway 
    Properties: 
     AllocationId: !GetAtt NonProdNATEIP.AllocationId 
     SubnetId: !Ref DevPublicSubnetA 
     SubnetId: !Ref DevPublicSubnetB 
    DependsOn: 
     - NonProdNATEIP 
     - DevPublicSubnetA 
     - DevPublicSubnetB 

    NonProdGWVPCAttachment: 
    Type: AWS::EC2::VPCGatewayAttachment 
    Properties: 
     InternetGatewayId: !Ref NonProdNATGateway 
     VpcId: !Ref DevVPC 
    DependsOn: 
     - NonProdNATGateway 

    Route: 
    Type: AWS::EC2::Route 
    Properties: 
     RouteTableId: 
     Ref: RouteTable 
     DestinationCidrBlock: 0.0.0.0/0 
     NatGatewayId: 
     Ref: NonProdNATGateway 

    PrivateRouteTableAssociation: 
    Type: AWS::EC2::SubnetRouteTableAssociation 
    Properties: 
     RouteTableId: !Ref RouteTable 
     SubnetId: !Ref DevPrivateSubnetA 
     SubnetId: !Ref DevPrivateSubnetB 

    PublicRouteTableAssociation: 
    Type: AWS::EC2::SubnetRouteTableAssociation 
    Properties: 
     RouteTableId: !Ref RouteTable 
     SubnetId: !Ref DevPublicSubnetA 
     SubnetId: !Ref DevPublicSubnetB 

Mappings: 
    R53EnvironmentMapping: 
    dev: 
     oregonawslocal: mydomain.oregon-dev.local 

Outputs: 

    DevPublicSubnetA: 
    Description: ID for dev subnet A 
    Value: !Ref DevPublicSubnetA 
    Export: 
     Name: DevPublicSubnetA 

    DevPublicSubnetB: 
    Description: ID for dev subnet B 
    Value: !Ref DevPublicSubnetB 
    Export: 
     Name: DevPublicSubnetB 

    DevPrivateSubnetA: 
    Description: ID for dev subnet A 
    Value: !Ref DevPrivateSubnetA 
    Export: 
     Name: DevPrivateSubnetA 

    DevPrivateSubnetB: 
    Description: ID for dev subnet B 
    Value: !Ref DevPrivateSubnetB 
    Export: 
     Name: DevPrivateSubnetB 

    DevRoute53OregonAWSLocalHostedZone: 
    Description: Hosted zone ID for hosted zone 
    Value: !Ref DevRoute53HostedZone 
    Export: 
     Name: DevRoute53OregonAWSLocalHostedZone 

    DevRoute53OregonAWSLocalHostedZoneName: 
    Description: Hosted zone name for hosted zone 
    Value: !FindInMap [R53EnvironmentMapping, dev, oregonawslocal] 
    Export: 
     Name: DevRoute53OregonAWSLocalHostedZoneName 

Answer 1

如在comment提到Michael - sqlbot，有一个问题是，你引用了AWS::EC2::VPCGatewayAttachment资源的InternetGatewayId属性，它需要一个AWS::EC2::InternetGateway资源的AWS::EC2::NATGateway资源。

NAT Gateways和Internet Gateways是两种不同类型的AWS资源：NAT网关仅提供对出站专用子网的出站Internet访问，而Internet网关提供对公用子网的双向Internet访问。

另一个问题是，您需要两组单独的AWS::EC2::RouteTable和AWS::EC2::Route资源，一组用于公用子网，另一组用于私有子网。公共路由应该有GatewayId引用Internet网关，并且私有路由应该有NatGatewayId引用NAT网关。

最后，您在几个资源（NatGateway,SubnetRouteTableAssociation）中有一些无效的重复SubnetId属性 - 每个这些资源只有一个点接受单个子网ID。

由于您是CloudFormation初学者，我强烈建议您利用参考VPC架构快速入门，利用AWS Quick Start的Amazon VPC Architecturetemplate。此AWS支持的模板在每个指定的可用区域（您提供2-4个可用区作为参数）内创建一个包含公有和私有子网的VPC。您可以稍后自定义此模板，以根据需要更好地满足您的特定需求，或将其用作配置自己模板资源的参考。