2

LoadBalancer に関連付けられていないため、ターゲット グループの作成は失敗します。しかし、パラメーターを使用して明示的に渡しています...ポリシーの問題でしょうか?

AWSTemplateFormatVersion: 2010-09-09
Description: CF template for Service.

Parameters:
    ClusterArn:
        Type: String
        Description: The Cluster ARN in which to launch the service.
    VPCId:
        Type: AWS::EC2::VPC::Id
        Description: The VPC Id in which the service will be launched.
    FrontEndALBHTTPListenerArn:
        Type: String
        Description: The listener Arn for the back-end service type.
    ALBHostedZoneId:
        Type: String
        Description: The HZ to add the DNS Record.
    LoadBalancerDNSName:
        Type: String
        Description: Load balancer DNS Name.

Resources:
    CustomerHTTPListerRule:
        Type: AWS::ElasticLoadBalancingV2::ListenerRule
        Properties:
            Actions:
                - Type: forward
                  TargetGroupArn:
                    !Ref FrontEndBackEndHTTPTargetGroup
            Conditions:
                - Field: host-header
                  Values:
                      - customer.services.company.com
            Priority: 5
            ListenerArn: !Ref FrontEndALBHTTPListenerArn
# Task Definition
    FrontEndTaskDefinition:
        Type: AWS::ECS::TaskDefinition
        Properties:
            NetworkMode: bridge
            Family: front-end
            ContainerDefinitions:
                -
                  Name: front-end
                  Image: 'xxx.xxx.ecr.xxx.amazonaws.com/frontend'
                  Memory: 128
                  PortMappings:
                    -
                      ContainerPort: 80
                      HostPort: 0
                  Essential: true
                  Environment:
                    - Name: ENVIRONMENT
                      Value: test
# Service Definition
    FrontEndServiceDefinition:
        Type: AWS::ECS::Service
        Properties:
            Cluster: !Ref ClusterArn
            DeploymentConfiguration:
                MinimumHealthyPercent: 50
                MaximumPercent: 200
            DesiredCount: 1
            HealthCheckGracePeriodSeconds: 30
            LaunchType: EC2
            TaskDefinition: !Ref FrontEndTaskDefinition
            ServiceName: Customer
            PlacementStrategies:
                - Type: spread
                  Field: instanceId
            LoadBalancers:
                -
                  ContainerName: front-end
                  ContainerPort: 80
                  TargetGroupArn: !Ref FrontendHTTPTargetGroup
        DependsOn: FrontendHTTPTargetGroup

# front-end Target Group
    FrontendBackEndHTTPTargetGroup:
        Type: AWS::ElasticLoadBalancingV2::TargetGroup
        Properties:
            HealthCheckIntervalSeconds: 5
            HealthCheckPath: '/health'
            HealthCheckProtocol: HTTP
            HealthCheckTimeoutSeconds: 3
            HealthyThresholdCount: 3
            UnhealthyThresholdCount: 2
            Matcher:
                HttpCode: 200
            Name: front-end
            Port: 80
            Protocol: HTTP
            Tags:
                - Key: Name
                  Value: front-end
            TargetGroupAttributes:
                - Key: deregistration_delay.timeout_seconds
                  Value: 10
            TargetType: instance
            VpcId: !Ref VPCId

スタックにアタッチされたポリシーは次のとおりです。

 {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": 
                "ec2:DescribeInstances",
                "ec2:DescribeAddresses",
                "ec2:DescribeRegions",
                "ec2:DescribeSnapshots",
                "ecs:DescribeTaskDefinition",
                "ecs:DeregisterTaskDefinition",
                "ecs:CreateService",
                "ec2:DescribeVolumeStatus",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeNetworkInterfaceAttribute",
                "ecs:RegisterTaskDefinition",
                "ec2:DescribeVolumes",
                "ecs:DescribeServices",
                "ec2:DescribeNetworkInterfacePermissions",
                "ec2:DescribeKeyPairs",
                "ec2:DescribeNetworkAcls",
                "ec2:DescribeRouteTables",
                "ec2:DescribeCustomerGateways",
                "ec2:DescribeVpcEndpointConnectionNotifications",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpc*",
                "route53:ListHostedZones",
                "route53:ChangeResourceRecordSets",
                "route53:ListResourceRecordSets",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:CreateListener",
                "elasticloadbalancing:DescribeListeners",
                "elasticloadbalancing:CreateRule",
                "elasticloadbalancing:DeleteRule",
                "elasticloadbalancing:ModifyTargetGroupAttributes",
                "elasticloadbalancing:CreateTargetGroup",
                "elasticloadbalancing:ModifyTargetGroup",
                "elasticloadbalancing:ModifyRule",
                "elasticloadbalancing:AddTags",
                "elasticloadbalancing:DescribeTargetHealth",
                "elasticloadbalancing:DescribeTargetGroups",
                "elasticloadbalancing:DescribeRules",
                "elasticloadbalancing:DescribeLoadBalancerAttributes",
                "elasticloadbalancing:DeleteTargetGroup",
                "elasticloadbalancing:DescribeTargetGroupAttributes"
                "elasticloadbalancing:DeregisterTargets",
                "elasticloadbalancing:RegisterTargets",
                "elasticloadbalancing:ModifyListener"
            ],
            "Resource": "*"
        }
    ]
}

完全な管理者権限があれば、問題なくスタックを作成できます。

ポリシーがありませんか、dependsOn ですか?

これは、CloudFormation での ALB ターゲット グループの作成に関連している可能性がありますが、このスタックで ALB を定義していません。

4

3 に答える 3

0

ネットワーク ロード バランサーによって公開される fargate サービスがあります。これを AWS CDK Typescript で修正するには:

    const fargateService = new ecs.FargateService(this, 'FunkyFargateService', {
      // ...
    });
    const loadBalancer = new elb.NetworkLoadBalancer(this, 'LB', {
      vpc: vpc,
      internetFacing: true,
    });

    const targetGroup = new elb.NetworkTargetGroup(this, 'NetworkTargetGroup', {
      vpc,
      port: 50051,
      deregistrationDelay: cdk.Duration.seconds(5),
      targets: [fargateService],
    });
    const nl = new elb.NetworkListener(this, 'LoadBalancerListener', {
      loadBalancer,
      // certificates: certificates.map(c => ({ certificateArn: c.certificateArn })),
      // protocol: elb.Protocol.TLS,
      defaultTargetGroups: [targetGroup],
      port: 80,
    });
    fargateService.node.addDependency(nl);

これにより、Fargate サービスの次の CloudFormation 定義が生成されます。


"FunkyFargateServiceXXXX": {
      "Type": "AWS::ECS::Service",
      "Properties": {
        "Cluster": "funky-cluster",
        "DeploymentConfiguration": {
          "MaximumPercent": 200,
          "MinimumHealthyPercent": 100
        },
        "DesiredCount": 1,
        "EnableECSManagedTags": false,
        "HealthCheckGracePeriodSeconds": 20,
        "LaunchType": "FARGATE",
        "LoadBalancers": [
          {
            "ContainerName": "staging-funk",
            "ContainerPort": 50051,
            "TargetGroupArn": {
              "Ref": "NetworkTargetGroupXXX"
            }
          }
        ],
        "NetworkConfiguration": {
          "AwsvpcConfiguration": {
            "AssignPublicIp": "DISABLED",
            "SecurityGroups": [
              {
                "Fn::GetAtt": [
                  "FunkyFargateServiceSecurityGroupXXXX",
                  "GroupId"
                ]
              }
            ],
            "Subnets": [
              "subnet-XXX",
              "subnet-XXX"
            ]
          }
        },
        "ServiceName": "staging-funk",
        "TaskDefinition": {
          "Ref": "FunkyTaskDefinitionXXX"
        }
      },
      "DependsOn": [
        "LoadBalancerListenerXXX"
      ],
      "Metadata": {
        "aws:cdk:path": "FunkyStack/FunkyFargateService/Service"
      }
    }
于 2020-02-13T01:28:12.347 に答える
0

この問題は、リスナーとサービスの作成の間の競合状態でした。リスナーがまだ進行中または作成されたばかりのときに、サービスが作成されました。dependsonサービスに命令を追加すると、問題が解決しました。

于 2019-03-02T20:59:08.803 に答える