Блог

Главная - Вопросы по программированию - Обработчик ресурсов вернул сообщение: «Предоставлен недопустимый запрос: Правила не поддерживаются для прослушивателей балансировщика сетевой нагрузки

Обработчик ресурсов вернул сообщение: «Предоставлен недопустимый запрос: Правила не поддерживаются для прослушивателей балансировщика сетевой нагрузки

#amazon-web-services #amazon-cloudformation #amazon-ecs #aws-fargate #nlb

Вопрос:

Я создаю стек CloudFormation для автоматизации ECS и использую внутреннюю NLB.

У меня проблема с ListenerRule, который возвращает следующую ошибку в CloudFormation: Обработчик ресурсов вернул сообщение: «Предоставлен недопустимый запрос: Правила не поддерживаются для прослушивателей балансировщика сетевой нагрузки

Мой сценарий таков:

 AWSTemplateFormatVersion: 2010-09-09

Description: ECS Fargate

Parameters:

  Name:
    Type: String
  
  VPC:
    Type: AWS::EC2::VPC::Id

  Subnets:
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup::Id 

  CreationVCPEndpoint:
    Type: String
    AllowedValues: [true, false]

  DesiredCount:
    Type: String

Conditions:
  CreationVCPEndpointSelected: !Equals [!Ref CreationVCPEndpoint, true]

Resources:

# Endpoints necessários para o serviço do ECS funcionar.

  EndpointLogs:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .logs
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointS3:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointECR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.api
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointSSM:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointDKR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.dkr
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

# Criação do NLB Privado

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref Name
      Subnets: !Ref Subnets
      Type: network
      Scheme: internal
      Tags:
        - Key: Name
          Value: !Ref Name

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${Name}-tg
      VpcId: !Ref VPC
      Port: 80
      Protocol: TCP
      TargetType: ip

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref LoadBalancerListener
      Priority: 1
      Conditions:
        - Field: source-ip
          #Values:
          #  - /
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward

# Criação da IAM para o ECS

  ECSIAM:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: !Ref Name
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action: "*"
                Resource: "*"

# Criação do ECS Fargate

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Ref Name

  ECSService:
    Type: AWS::ECS::Service
    DependsOn: ListenerRule
    Properties:
      Cluster: !Ref ECSCluster
      Role: !Ref ECSIAM
      DesiredCount: !Ref DesiredCount
      TaskDefinition: !Ref ECSTaskDefinition
      LoadBalancers:
        - ContainerName: "website-service"
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup

  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: website-service
      NetworkMode: awsvpc
      ContainerDefinitions:
        - Name: website-service
          Essential: true
          Image: 489732776903.dkr.ecr.us-west-2.amazonaws.com/daniel:latest
          Memory: 128
          #Environment:
          #  - Name: PRODUCT_SERVICE_URL
          #    Value: !Ref ProductServiceUrl
          PortMappings:
            - ContainerPort: 80
          #LogConfiguration:
          #  LogDriver: awslogs
          #  Options:
          #    awslogs-group: !Ref CloudWatchLogsGroup
          #    awslogs-region: !Ref AWS::Region

Кто-нибудь знает, какова правильная конфигурация ListenerRule?

Комментарии:

1. Полностью удалите элемент прослушивания. NLB не может выполнять маршрутизацию уровня 7, поэтому вы можете использовать только действие по умолчанию.

2. @jordanm Я удалил ListenerRule и dependsOn из ECSService и вернул эту ошибку: Обработчик ресурсов вернул сообщение: «Предоставлен неверный запрос: Ошибка службы создания: Целевая группа с targetGroupArn arn:aws:балансировка эластичной нагрузки:сша-запад-2:[мой аккаунт]:целевая группа/teste-tg/1bbab9617a9dab6f не имеет связанного балансировщика нагрузки. (Служба: AmazonECS; Код состояния: 400; Код ошибки: Исключение недопустимого параметра; Идентификатор запроса: ede2cb41-288e-4dc2-b8ea-834ee95f61ba; Прокси-сервер: null)» (Запрос: c1cc36ec-cba6-e47e-fb8d-b269f259e439, Код ошибки обработчика: InvalidRequest)

Ответ №1:

Мне удалось правильно подобрать шаблон, шаблон готов.

 AWSTemplateFormatVersion: 2010-09-09

Description: ECS Fargate

Parameters:

  Name:
    Type: String
  
  VPC:
    Type: AWS::EC2::VPC::Id

  Subnets:
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup::Id 

  CreationVCPEndpoint:
    Type: String
    AllowedValues: [true, false]

  DesiredCount:
    Type: String

Conditions:
  CreationVCPEndpointSelected: !Equals [!Ref CreationVCPEndpoint, true]

Resources:

# Endpoints necessários para o serviço do ECS funcionar.

  EndpointLogs:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .logs
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointS3:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      PrivateDnsEnabled: false
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointECR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.api
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointSSM:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointDKR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.dkr
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

# Criação do NLB Privado

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref Name
      Subnets: !Ref Subnets
      Type: network
      Scheme: internal
      Tags:
        - Key: Name
          Value: !Ref Name

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub ${Name}-tg
      VpcId: !Ref VPC
      Port: 80
      Protocol: TCP
      TargetType: ip

# Criação da IAM para o ECS

  ECSIAM:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
                - "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: !Ref Name
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action: "*"
                Resource: "*"

# Criação do ECS Fargate

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Ref Name

  ECSService:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancerListener
    Properties:
      Cluster: !Ref ECSCluster
      LaunchType: FARGATE
      DesiredCount: !Ref DesiredCount
      TaskDefinition: !Ref ECSTaskDefinition
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - sg-0c2e8f8e84a22bdd4
          Subnets:
            - subnet-04d79b3e4ac16ba6f
            - subnet-07baab102179ee184
      LoadBalancers:
        - ContainerName: "test-container"
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup

  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: test-container
      NetworkMode: awsvpc
      Cpu: 512
      Memory: 1024
      ExecutionRoleArn: !Ref ECSIAM
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: test-container
          Essential: true
          Image: URI
          Cpu: 512
          Memory: 1024
          PortMappings:
            - ContainerPort: 80
Метки: