cloudformation 因安全组不匹配而失败

Question

我正在尝试为我的数据库设置我的 cloudformation：

"VPC" : {
  "Type" : "AWS::EC2::VPC",
  "Properties" : {
    "CidrBlock" : "10.0.0.0/16",
    "EnableDnsSupport" : "false",
    "EnableDnsHostnames" : "false",
    "InstanceTenancy" : "default",
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"Subnet" : {
  "Type" : "AWS::EC2::Subnet",
  "Properties" : {
    "VpcId" : { "Ref" : "VPC" },
    "CidrBlock" : "10.0.0.0/16",
    "AvailabilityZone" : { "Fn::Select": [ "0", { "Fn::GetAZs" : { "Ref" : "AWS::Region" } }]},
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"SecurityGroup" : {
  "Type" : "AWS::EC2::SecurityGroup",
  "Properties" : {
    "GroupDescription" : "Allow http to client host",
    "VpcId" : {"Ref" : "VPC"},
    "SecurityGroupIngress" : [{
      "IpProtocol" : "tcp",
      "FromPort" : "3306",
      "ToPort" : "3306",
      "CidrIp" : "10.0.0.0/16"
    }],
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"Database" : {
  "Type" : "AWS::RDS::DBInstance",
  "Properties" : {
    "DBName" : { "Fn::Join": ["", { "Fn::Split": [".", { "Ref" : "DomainName" }]}]},
    "AllocatedStorage" : "5",
    "DBInstanceClass" : "db.t2.micro",
    "Engine" : "MySQL",
    "EngineVersion" : "5.5",
    "MasterUsername" : { "Ref": "DBUsername" },
    "MasterUserPassword" : { "Ref": "DBPassword" },
    "VPCSecurityGroups" : [ { "Fn::GetAtt": [ "SecurityGroup", "GroupId" ] } ],
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  },
  "DeletionPolicy" : "Snapshot"
},

应该为数据库设置 VPC。但是当我运行 cloudformation 模板时，出现以下错误：

UPDATE_FAILED AWS::RDS::DBInstance Database Database is in vpc-3081245b, but Ec2 Security Group sg-b122ffca is in vpc-f7173290

如何正确获取 VPC 中的数据库？

Answer 1

作为数据库定义的一部分，您可以指定 DBSubnetGroupName。

A DB Subnet Group 提供了允许数据库运行的子网列表。数据库子网组中的每个子网都属于一个 VPC。

因此，您需要对您的 Amazon CloudFormation 模板执行以下操作：

添加 AWS::RDS::DBSubnetGroup，指定已在您的模板中定义的 Subnet
将 DBSubnetGroupName 参数添加到您的 AWS::RDS::DBInstance 定义中

cloudformation 因安全组不匹配而失败

cloudformation failing with security group mismatch

amazon-web-services

amazon-cloudformation