Error when create a stack on CloudFormation using a yaml file : Resource handler returned message: "If the target type is ALB, the target must have at least one listener that matches the target group

Question

Hi team, I'm trying to use a yaml file to create resources on my aws instance.
When creating stack using attached yaml file, i receive this error : Resource handler returned message: "If the target type is ALB, the target must have at least one listener that matches the target group port or any specified port overrides (Service: ElasticLoadBalancingV2, Status Code: 400, Request ID: 503838d2-e0c0-4a46-9174-da5e2565890f)" (RequestToken: ec35aaf5-3986-da2a-1e66-c3d71310c68b, HandlerErrorCode: GeneralServiceException)

Logical ID= SFPrvConnectNLBTgtGrp

**yaml file:**

*AWSTemplateFormatVersion: 2010-09-09

Parameters:

# vpc ID
  CustomerVPCId:
    Type: String
    Description: 'Enter the VPC Id to create resources in.'
# Private subnets to host resources
  PrivateSubnetId1:
    Type: String
    Description: 'Enter the first private subnet Id'
  PrivateSubnetId2:
    Type: String
    Description: 'Enter the second private subnet Id'
# SF IAM Prinicpal ARN
  SFSrcArn:
    Type: String
    Description: Enter the Salesforce IAM ARN.
# 
#

Resources:

#VPC endpoint service permissions
  SFPrvConnectVPCEPerms:
    Type: AWS::EC2::VPCEndpointServicePermissions
    Properties: 
      AllowedPrincipals: 
      - !Ref SFSrcArn
      ServiceId: !Ref SFPrvConnectVPCE
    DependsOn: SFPrvConnectVPCE

#SecurityGroup-ingress rules
  SFPrvConnectALBSecGrpIngressRules:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: !Ref SFPrvConnectALBSecGrp
      CidrIp: '0.0.0.0/0'
      Description: 'Allow inbound http traffic from IP any'
      FromPort: 80
      IpProtocol: 'tcp'
      ToPort: 80
    DependsOn: SFPrvConnectALBSecGrp

#SecurityGroup-egress rules
  SFPrvConnectALBSecGrpEgressRules:
    Type: AWS::EC2::SecurityGroupEgress
    Properties:
      GroupId: !Ref SFPrvConnectALBSecGrp
      CidrIp: '0.0.0.0/0'
      Description: 'Allows all outbound traffic'
      FromPort: 1
      IpProtocol: '-1'
      ToPort: 65535
    DependsOn: SFPrvConnectALBSecGrp

#SecurityGroup-for ALB
  SFPrvConnectALBSecGrp:
    Type: AWS::EC2::SecurityGroup
    Properties: 
      GroupDescription: 'SG attached to private connect ALB. allows http traffic.'
      GroupName: 'prvConnect-alb-sg'
      VpcId: 
        !Ref CustomerVPCId

#ALB listener on port 80 forwarding to ALB target grp
  SFPrvConnectALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties: 
      DefaultActions: 
        - TargetGroupArn: !Ref SFPrvConnectALBTgtGrp
          Type: 'forward'
      LoadBalancerArn: !Ref SFPrvConnectEC2ALB
      Port: 80
      Protocol: 'HTTP'
    DependsOn: SFPrvConnectALBTgtGrp

#NLB listener on port 80 forwarding to NLB target grp
  SFPrvConnectNLBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties: 
      DefaultActions: 
        - TargetGroupArn: !Ref SFPrvConnectNLBTgtGrp
          Type: 'forward'
      LoadBalancerArn: !Ref SFPrvConnectNLB
      Port: 80
      Protocol: 'TCP'
    DependsOn: SFPrvConnectNLBTgtGrp

#ALB-TargetGroup - routes traffic to EC2
  SFPrvConnectALBTgtGrp:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties: 
      HealthCheckEnabled: 'true'
      IpAddressType: 'ipv4'
      Name: 'SFPrvConnectALBTgtGrp'
      Port: 80
      Protocol: 'HTTP'
      TargetType: 'ip'
      VpcId: !Ref CustomerVPCId
    DependsOn: SFPrvConnectEC2ALB

#NLB-TargetGroup - routes traffic to an ALB
  SFPrvConnectNLBTgtGrp:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties: 
      IpAddressType: 'ipv4'
      Name: 'SFPrvConnectNLBTgtGrp'
      Port: 80
      Protocol: 'TCP'
      Targets: 
        - Id: !Ref SFPrvConnectEC2ALB
          Port: 80
      TargetType: 'alb'
      VpcId: !Ref CustomerVPCId
    DependsOn: SFPrvConnectNLB

#NLB
  SFPrvConnectNLB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      IpAddressType: 'ipv4'
      LoadBalancerAttributes: 
        - Key: load_balancing.cross_zone.enabled
          Value: 'true'
      Name: 'SFPrivateConnect-demo-nlb'
      Scheme: 'internal'
      Subnets: 
        - !Ref PrivateSubnetId1
        - !Ref PrivateSubnetId2
      Type: 'network'

#ALB-EC2
  SFPrvConnectEC2ALB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      IpAddressType: 'ipv4'
      SecurityGroups:
        - Fn::GetAtt: SFPrvConnectALBSecGrp.GroupId
      Name: 'SFPrivateConnect-demo-alb'
      Scheme: 'internal'
      Subnets: 
        - !Ref PrivateSubnetId1
        - !Ref PrivateSubnetId2
      Type: 'application'
    DependsOn: SFPrvConnectALBSecGrp

#VPC-Endpoint
  SFPrvConnectVPCE:
    Type: AWS::EC2::VPCEndpointService
    Properties: 
      AcceptanceRequired: 'false'
      NetworkLoadBalancerArns: 
        - !Ref SFPrvConnectNLB
    DependsOn: SFPrvConnectNLB

Outputs:

SFVPCEndpointID: 
    Description: "The privateLink VPC endpoint service ID"
    Value: !Ref SFPrvConnectVPCE

SFNLBDNSName:
    Description: 'URL for the Network Load Balancer assigned to the VPC endpoint.'
    Value: !GetAtt SFPrvConnectNLB.DNSName*

Accepted Answer

That's great ! Thanks, it is the solution.

Answer

The error might be since the NLB Target Group(`SFPrvConnectNLBTgtGrp`) is getting created before ALB Listener (`SFPrvConnectALBListener`) gets created on the stack. When this happens NLB Target Group creation fails, since there is no ALB Listener available yet.

To avoid this add a `DependsOn` on the `SFPrvConnectNLBTgtGrp` Resource, so that it waits for `SFPrvConnectALBListener` to get created successfully and only then starts creation of `SFPrvConnectNLBTgtGrp`.

Adding the DependsOn would look like this:

```
  # NLB-TargetGroup - routes traffic to an ALB
  SFPrvConnectNLBTgtGrp:
    DependsOn: 
     - SFPrvConnectALBListener
     - SFPrvConnectNLB
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      IpAddressType: 'ipv4'
      Name: 'SFPrvConnectNLBTgtGrp'
......
......
```
Hope this helps.

Answer

yes this is want I want to do

Error when create a stack on CloudFormation using a yaml file : Resource handler returned message: "If the target type is ALB, the target must have at least one listener that matches the target group

vpc ID

Private subnets to host resources

SF IAM Prinicpal ARN

相关内容