在 Cloudformation 模板中传递安全组 ID 和子网 ID

Question

Parameters:
  ClusterName:
    Type: String
  ClusterVersion:
    Type: Number
    AllowedValues: [1.21, 1.20, 1.19, 1.18]
  RoleArnValue:
    Type: String
  ListOfSubnetIDs: 
    Description: Array of Subnet IDs
    Type: List<AWS::EC2::Subnet::Id>
  ListOfSecurityGroupIDs:
    Description: Array of security group ids
    Type: List<AWS::EC2::SecurityGroup::Id>


Resources:
  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: !Sub ${ClusterName}
      Version: !Sub ${ClusterVersion}
      RoleArn: !Sub ${RoleArnValue}
      ResourcesVpcConfig:
        SecurityGroupIds: 
          - !Sub ${ListOfSecurityGroupIDs}
        SubnetIds:
          - !Sub ${ListOfSubnetIDs}

以上是我创建的 .yaml clouldformation 模板，因此我可以启动 eks 集群。然后我使用 aws cli 使用以下命令启动集群。

aws cloudformation deploy --template-file eks.yaml --stack-name cluster-test --parameter-overrides ClusterName=Dev ClusterVersion=1.21 ListOfSubnetIDs=subnet-11111d11b11b011f4,subnet-99999d237f87f11d7,subnet-222222c110c7e4be7,subnet-88888884de8d25176  ListOfSecurityGroupIDs=sg-01111111a21221 RoleArnValue=arn:aws:iam::123456546456:role/cluster-ServiceRole-WMIC72AOWSP0 --capabilities CAPABILITY_NAMED_IAM

我收到以下错误

An error occurred (ValidationError) when calling the CreateChangeSet operation: Template error: variable ListOfSecurityGroupIDs in Fn::Sub expression does not resolve to a string

我不知道为什么。我正确使用 !sub 吗？非常感谢对此的投入。

Answer 1

由于您希望按原样引用您提供给模板的参数，因此您应该使用 Ref 函数。

这是一个有效模板的示例：

Parameters:
  ClusterName:
    Type: String
  RoleArnValue:
    Type: String
  ListOfSubnetIDs: 
    Description: Array of Subnet IDs
    Type: List<AWS::EC2::Subnet::Id>
  ListOfSecurityGroupIDs:
    Description: Array of security group ids
    Type: List<AWS::EC2::SecurityGroup::Id>


Resources:
  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: !Ref ClusterName
      RoleArn: !Ref RoleArnValue
      ResourcesVpcConfig:
        SecurityGroupIds: !Ref ListOfSecurityGroupIDs
        SubnetIds: !Ref ListOfSubnetIDs

下面是我的部署方式：

aws cloudformation deploy --template-file eks.yml --stack-name cluster-test --parameter-overrides ClusterName=Dev ListOfSubnetIDs=subnet-be0a99c4,subnet-c71046ae ListOfSecurityGroupIDs=sg-009690ac6b3bff6df,sg-009a3f1cb63943941 -RoleArnValue=...

Sub 应该在你想执行字符串操作时使用。查看 documentation.

中的示例

在 Cloudformation 模板中传递安全组 ID 和子网 ID

Passing Security Group Ids and Subnet Ids in a Clould Formation template

amazon-web-services

yaml

amazon-cloudformation

aws-cli