如何使用 CloudFormation 將路由新增至 VPC 中的主要路由表?
3 分的閱讀內容
0
當我在 AWS CloudFormation 中建立 Amazon Virtual Private Cloud (Amazon VPC) 時,我想將路由新增至主要路由表。
簡短說明
當您使用 CloudFormation 建立 Amazon VPC 時,CloudFormation 無法辨識預設建立的主要路由表。因此,路由表的相關資訊無法在您的 Amazon VPC 和 CloudFormation 之間傳遞。結果便是您無法在主要路由表新增或移除路由,因為無法從 CloudFormation 範本參考路由表。
解決方案
**注意事項:**如果您在執行 AWS Command Line Interface (AWS CLI) 命令時收到錯誤,請確定您使用最新的 AWS CLI 版本。
若要解決此問題,您可以在 CloudFormation 範本中使用 AWS Lambda 支援的自訂資源。CloudFormation 堆疊會建立一個 Amazon VPC。然後,自訂資源會使用 AWS Lambda 函數擷取與您 Amazon VPC 相關聯的主要路由表 ID。
使用下列 RouteTable-template.yml 範本建立 CloudFormation 堆疊:
AWSTemplateFormatVersion: 2010-09-09 Description: Template to add routes to default/main routetable of VPC Resources: MyVPC: Type: 'AWS::EC2::VPC' Properties: CidrBlock: 10.0.0.0/16 Tags: - Key: Env Value: Test LambdaIAMRole: Type: 'AWS::IAM::Role' DependsOn: MyVPC Properties: AssumeRolePolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Principal: Service: - lambda.amazonaws.com Action: - 'sts:AssumeRole' Path: / Policies: - PolicyName: root PolicyDocument: Version: 2012-10-17 Statement: - Effect: Allow Action: - 'ec2:Describe*' Resource: '*' - Effect: Allow Action: - 'logs:CreateLogGroup' - 'logs:CreateLogStream' - 'logs:PutLogEvents' Resource: 'arn:aws:logs:*:*:*' LambdaFunction: Type: 'AWS::Lambda::Function' Properties: Handler: index.lambda_handler Role: !GetAtt LambdaIAMRole.Arn Runtime: python3.9 Timeout: 50 Code: ZipFile: | from __future__ import print_function import json import boto3 import urllib3 import cfnresponse SUCCESS = "SUCCESS" FAILED = "FAILED" http = urllib3.PoolManager() print('Loading function') ec2 = boto3.client('ec2') def lambda_handler(event, context): print("Received event: " + json.dumps(event, indent=2)) responseData={} try: if event['RequestType'] == 'Delete': print("Request Type:",event['RequestType']) print("Delete Request - No Physical resources to delete") elif event['RequestType'] == 'Create': print("Request Type:",event['RequestType']) VPCID=event['ResourceProperties']['VPCID'] RouteTableID=get_vpc(VPCID) responseData={'RouteTableID':RouteTableID} print("Sending response to custom resource") elif event['RequestType'] == 'Update': print("Request Type:",event['RequestType']) VPCID=event['ResourceProperties']['VPCID'] RouteTableID=get_vpc(VPCID) responseData={'RouteTableID':RouteTableID} print("Sending response to custom resource") responseStatus = 'SUCCESS' print("responseStatus: " + responseStatus) cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID") except Exception as e: print('Failed to process:', e) responseStatus = 'FAILURE' responseData = {'Failure': 'Something bad happened.'} cfnresponse.send(event, context, cfnresponse.FAILURE, responseData, "CustomResourcePhysicalID") def get_vpc(VPCID): response = ec2.describe_route_tables ( Filters=[ { 'Name': 'association.main', 'Values': [ 'true' ] }, { 'Name': 'vpc-id', 'Values': [ VPCID ] } ] ) print("Printing the VPC Route Table ID ....") RouteTableID=response['RouteTables'][0]['RouteTableId'] print(RouteTableID) return RouteTableID def send(event, context, responseStatus, responseData, physicalResourceId=None, noEcho=False): responseUrl = event['ResponseURL'] print(responseUrl) responseBody = {'Status': responseStatus, 'Reason': 'See the details in CloudWatch Log Stream: ' + context.log_stream_name, 'PhysicalResourceId': physicalResourceId or context.log_stream_name, 'StackId': event['StackId'], 'RequestId': event['RequestId'], 'LogicalResourceId': event['LogicalResourceId'], 'Data': responseData} json_responseBody = json.dumps(responseBody) print("Response body:\n" + json_responseBody) headers = { 'content-type' : '', 'content-length' : str(len(json_responseBody)) } try: response = http.request('PUT', responseUrl, headers=headers, body=json_responseBody) print("Status code: " + response.reason) except Exception as e: print("send(..) failed executing requests.put(..): " + str(e)) Lambdatrigger: Type: 'Custom::RouteTableLambda' Properties: ServiceToken: !GetAtt LambdaFunction.Arn VPCID: !Ref MyVPC MyInternetGateway: Type: 'AWS::EC2::InternetGateway' Properties: Tags: - Key: Env Value: Test AttachGateway: Type: 'AWS::EC2::VPCGatewayAttachment' Properties: VpcId: !Ref MyVPC InternetGatewayId: !Ref MyInternetGateway MyRoute: Type: 'AWS::EC2::Route' Properties: RouteTableId: !GetAtt Lambdatrigger.RouteTableID DestinationCidrBlock: 0.0.0.0/0 GatewayId: !Ref MyInternetGateway Outputs: RouteTableID: Value: !GetAtt Lambdatrigger.RouteTableID
自訂資源傳回的資料包含主要路由表 ID。您可以在 AWS::EC2::Route 中使用 GetAtt 參考 ID,以將路由新增至主要路由表。此外,堆疊的輸出會顯示路由表 ID。
以下是自訂資源傳送至 CloudFormation 堆疊的 SUCCESS 回應內文範例:
{ "Status": "SUCCESS", "Reason": "See the details in CloudWatch Log Stream: 2022/08/31/[$LATEST]c48b90efb3944c11ad3fb6e1ce5e1f45", "PhysicalResourceId": "CustomResourcePhysicalID", "StackId": "arn:aws:cloudformation:us-west-1:XXXX:stack/VPC-RT/06c957b0-297e-11ed-afb5-02ca6fd67f8d", "RequestId": "55c0f2b8-3044-47f7-aba4-84502b4ef632", "LogicalResourceId": "Lambdatrigger", "NoEcho": false, "Data": { "RouteTableID": "rtb-0fba8d15701234567a" } }
AWS 官方已更新 2 年前
沒有評論
相關內容
- 已提問 9 個月前lg...
- 已提問 3 個月前lg...
- 已提問 9 個月前lg...
- 已提問 10 個月前lg...
- AWS 官方已更新 1 年前