Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
InstanceType:
Description: WebServer EC2 instance type
Type: String
Default: t3.micro
AllowedValues:
- t3.nano
- t3.micro
- t3.small
- t3.medium
- t3a.nano
- t3a.micro
- t3a.small
- t3a.medium
- m5.large
- m5.xlarge
- m5.2xlarge
- m5a.large
- m5a.xlarge
- m5a.2xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
ConstraintDescription: must be a valid EC2 instance type.
Resources:
WebServerInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: !Ref LatestAmiId
InstanceType: !Ref InstanceType
SecurityGroupIds:
- !Ref WebServerSecurityGroup
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
# Get the latest CloudFormation package
yum update -y aws-cfn-bootstrap
# Run cfn-init
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerInstance --region ${AWS::Region} || error_exit 'Failed to run cfn-init'
# Start up the cfn-hup daemon to listen for changes to the EC2 instance metadata
/opt/aws/bin/cfn-hup || error_exit 'Failed to start cfn-hup'
# Signal success or failure
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerInstance --region ${AWS::Region}
Metadata:
AWS::CloudFormation::Init:
config:
packages:
yum:
httpd: []
php: []
files:
/var/www/html/index.php:
content: |
Hello World!";
?>
mode: '000644'
owner: apache
group: apache
/etc/cfn/cfn-hup.conf:
content: !Sub |
[main]
stack=${AWS::StackId}
region=${AWS::Region}
# The interval used to check for changes to the resource metadata in minutes. Default is 15
interval=2
mode: '000400'
owner: root
group: root
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
content: !Sub |
[cfn-auto-reloader-hook]
triggers=post.update
path=Resources.WebServerInstance.Metadata.AWS::CloudFormation::Init
action=/opt/aws/bin/cfn-init -s ${AWS::StackId} -r WebServerInstance --region ${AWS::Region}
runas=root
services:
systemd:
httpd:
enabled: true
ensureRunning: true
cfn-hup:
enabled: true
ensureRunning: true
files:
- /etc/cfn/cfn-hup.conf
- /etc/cfn/hooks.d/cfn-auto-reloader.conf
CreationPolicy:
ResourceSignal:
Timeout: PT5M
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
Outputs:
WebsiteURL:
Value: !Sub 'http://${WebServerInstance.PublicDnsName}'
Description: URL of the web application
```
**Untuk meluncurkan tumpukan dari template ini**
1. Salin template dan simpan secara lokal di sistem Anda sebagai file teks. Catat lokasinya karena Anda harus menggunakan file di langkah berikutnya.
1. Masuk ke Konsol Manajemen AWS dan buka CloudFormation konsol di [https://console.aws.amazon.com/cloudformation](https://console.aws.amazon.com/cloudformation/).
1. Pilih **Buat tumpukan, Dengan sumber daya baru (standar)**.
1. Pilih **Pilih template yang sudah ada**.
1. Di bawah **Tentukan templat**, pilih **Unggah file templat** dan telusuri file yang Anda buat pada langkah pertama, lalu pilih **Berikutnya**.
1. Pada halaman **Tentukan detail tumpukan**, masukkan **UpdateTutorial** sebagai nama tumpukan.
1. Di bawah **Parameter**, jaga agar semua parameter tetap sama dan pilih **Berikutnya** dua kali.
1. Pada layar **Tinjau dan buat**, pilih **Kirim**.
Setelah status tumpukan Anda`CREATE_COMPLETE`, tab **Output** akan menampilkan URL situs web Anda. Jika Anda memilih nilai `WebsiteURL` output, Anda akan melihat aplikasi PHP baru Anda bekerja.
## Langkah 2: Perbarui aplikasi
Karena kita sudah men-deploy tumpukan, mari kita perbarui aplikasi ini. Kami akan membuat perubahan sederhana pada teks yang dicetak oleh aplikasi. Untuk melakukannya, kita akan menambahkan perintah echo ke file index.php seperti yang ditunjukkan dalam snippet templat ini:
```
files:
/var/www/html/index.php:
content: |
Hello World!";
echo "This is an updated version of our application.
";
?>
mode: '000644'
owner: apache
group: apache
```
Gunakan editor teks untuk secara manual mengedit file templat yang Anda simpan secara lokal.
Sekarang, perbarui tumpukan.
**Untuk memperbarui tumpukan dengan template Anda yang diperbarui**
1. Di CloudFormation konsol, pilih **UpdateTutorial** tumpukan Anda.
1. Pilih **Perbarui, Buat pembaruan langsung**.
1. Pilih **Ganti template yang ada**.
1. Di bawah **Tentukan templat**, pilih **Unggah file templat** dan unggah file templat Anda yang dimodifikasi, lalu pilih **Berikutnya**.
1. Pada halaman **Tentukan detail tumpukan**, jaga agar semua parameter tetap sama dan pilih **Berikutnya** dua kali.
1. Pada halaman **Ulasan**, tinjau perubahannya. Di bawah **Perubahan**, Anda akan melihat bahwa CloudFormation akan memperbarui `WebServerInstance` sumber daya.
1. Pilih **Kirim**.
Ketika tumpukan Anda dalam `UPDATE_COMPLETE` status, Anda dapat memilih nilai `WebsiteURL` output lagi untuk memverifikasi bahwa perubahan pada aplikasi Anda telah berlaku. `cfn-hup`Daemon berjalan setiap 2 menit, jadi mungkin perlu waktu hingga 2 menit agar aplikasi berubah setelah tumpukan diperbarui.
Untuk melihat kumpulan sumber daya yang diperbarui, buka CloudFormation konsol. Di tab **Peristiwa**, llihat peristiwa tumpukan. Dalam kasus khusus ini, metadata untuk EC2 instans Amazon `WebServerInstance` diperbarui, yang CloudFormation menyebabkan juga mengevaluasi kembali resource (`WebServerSecurityGroup`) lainnya untuk memastikan bahwa tidak ada perubahan lain. Tidak ada sumber daya tumpukan lainnya yang dimodifikasi. CloudFormation hanya akan memperbarui sumber daya di tumpukan yang terpengaruh oleh perubahan apa pun pada tumpukan. Perubahan tersebut dapat langsung, seperti properti atau perubahan metadata, atau dapat disebabkan oleh dependensi atau aliran data melalui`Ref`,`GetAtt`, atau fungsi template intrinsik lainnya. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
Pembaruan sederhana ini menggambarkan prosesnya. Namun, Anda dapat membuat perubahan yang jauh lebih kompleks pada file dan paket yang disebarkan ke EC2 instance Amazon Anda. Misalnya, Anda mungkin memutuskan bahwa Anda perlu menambahkan MySQL ke instans, bersama dengan dukungan PHP untuk MySQL. Untuk melakukannya, cukup tambahkan paket dan file tambahan bersama dengan layanan tambahan apa pun ke konfigurasi, lalu perbarui tumpukan untuk menerapkan perubahan.
```
packages:
yum:
httpd: []
php: []
mysql: []
php-mysql: []
mysql-server: []
mysql-libs: []
...
services:
systemd:
httpd:
enabled: true
ensureRunning: true
cfn-hup:
enabled: true
ensureRunning: true
files:
- /etc/cfn/cfn-hup.conf
- /etc/cfn/hooks.d/cfn-auto-reloader.conf
mysqld:
enabled: true
ensureRunning: true
```
Anda dapat memperbarui CloudFormation metadata untuk memperbarui ke versi baru dari paket yang digunakan oleh aplikasi. Dalam contoh sebelumnya, properti versi untuk setiap paket kosong, menunjukkan bahwa `cfn-init` harus menginstal versi terbaru dari paket.
```
packages:
yum:
httpd: []
php: []
```
Anda dapat secara opsional menentukan string versi untuk paket. Jika Anda mengubah string versi dalam panggilan tumpukan pembaruan berikutnya, versi baru dari paket akan di-deploy. Berikut adalah contoh penggunaan nomor versi untuk RubyGems paket. Setiap paket yang mendukung versioning dapat memiliki versi tertentu.
```
packages:
rubygems:
mysql: []
rubygems-update:
- "1.6.2"
rake:
- "0.8.7"
rails:
- "2.3.11"
```
## Langkah 3: Tambahkan akses SSH dengan key pair
Anda juga dapat memperbarui sumber daya dalam template untuk menambahkan properti yang awalnya tidak ditentukan dalam template. Untuk mengilustrasikannya, kami akan menambahkan EC2 key pair Amazon ke EC2 instance yang ada dan kemudian membuka port 22 di grup EC2 keamanan Amazon sehingga Anda dapat menggunakan Secure Shell (SSH) untuk mengakses instance.
**Untuk menambahkan akses SSH ke instans Amazon EC2 yang ada**
1. Tambahkan dua parameter tambahan ke template untuk meneruskan nama Amazon EC2 key pair dan lokasi SSH yang ada.
```
Parameters:
KeyName:
Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
Type: AWS::EC2::KeyPair::KeyName
ConstraintDescription: must be the name of an existing EC2 KeyPair.
SSHLocation:
Description: The IP address that can be used to SSH to the EC2 instances in CIDR format (e.g. 203.0.113.1/32)
Type: String
MinLength: 9
MaxLength: 18
Default: 0.0.0.0/0
AllowedPattern: '^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$'
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
```
1. Tambahkan `KeyName` properti ke EC2 instance Amazon.
```
WebServerInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: !Ref LatestAmiId
InstanceType: !Ref InstanceType
KeyName: !Ref KeyName
SecurityGroupIds:
- !Ref WebServerSecurityGroup
```
1. Tambahkan port 22 dan lokasi SSH ke aturan masuk untuk grup EC2 keamanan Amazon.
```
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80 and SSH access via port 22
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: !Ref SSHLocation
```
1. Perbarui tumpukan menggunakan langkah yang sama seperti yang dijelaskan di[Langkah 2: Perbarui aplikasi](#update-stack-update-application).
## Langkah 4: Perbarui jenis instans
Sekarang mari kita tunjukkan cara memperbarui infrastruktur yang mendasarinya dengan mengubah jenis instance.
Tumpukan yang kami buat sejauh ini menggunakan instance Amazon EC2 t3.micro. Misalkan situs web Anda yang baru dibuat mendapatkan lebih banyak lalu lintas daripada yang dapat ditangani oleh instans t3.micro, dan sekarang Anda ingin pindah ke jenis instans Amazon EC2 m5.large. Jika arsitektur tipe instance berubah, instance harus dibuat dengan AMI yang berbeda. Namun, baik t3.micro dan m5.large menggunakan arsitektur CPU yang sama dan menjalankan Amazon Linux 2 (x86\$164). AMIs Untuk informasi selengkapnya, lihat [Kompatibilitas untuk mengubah jenis instans](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/resize-limitations.html) di *Panduan EC2 Pengguna Amazon*.
Mari kita gunakan template yang kita modifikasi pada langkah sebelumnya untuk mengubah jenis instance. Karena `InstanceType` merupakan parameter input ke template, kita tidak perlu memodifikasi template; kita dapat mengubah nilai parameter pada halaman Specify **stack details**.
**Untuk memperbarui tumpukan dengan nilai parameter baru**
1. Di CloudFormation konsol, pilih **UpdateTutorial** tumpukan Anda.
1. Pilih **Perbarui, Buat pembaruan langsung**.
1. Pilih **Gunakan template yang ada**, lalu pilih **Berikutnya**.
1. Pada halaman **Tentukan detail tumpukan**, ubah nilai kotak **InstanceType**teks dari `t3.micro` menjadi`m5.large`. Kemudian, pilih **Berikutnya** dua kali.
1. Pada halaman **Ulasan**, tinjau perubahannya. Di bawah **Perubahan**, Anda akan melihat bahwa CloudFormation akan memperbarui `WebServerInstance` sumber daya.
1. Pilih **Kirim**.
Anda dapat mengubah jenis instans instans EC2 Amazon yang didukung EBS secara dinamis dengan memulai dan menghentikan instans. CloudFormation mencoba mengoptimalkan perubahan dengan memperbarui jenis instance dan memulai ulang instance, sehingga ID instance tidak berubah. Ketika instans dimulai ulang, tetapi, alamat IP publik dari instans tidak berubah. Untuk memastikan bahwa alamat IP Elastis terikat dengan benar setelah perubahan, juga CloudFormation akan memperbarui alamat IP Elastis. Anda dapat melihat perubahan di CloudFormation konsol pada tab **Acara**.
Untuk memeriksa jenis instance dari Konsol Manajemen AWS, buka EC2 konsol Amazon, dan temukan instance Anda di sana.
## Langkah 5: Perbarui AMI
Sekarang mari kita perbarui tumpukan kita untuk menggunakan Amazon Linux 2023, yang merupakan generasi berikutnya dari Amazon Linux.
Memperbarui AMI adalah perubahan besar yang memerlukan penggantian instance. Kita tidak bisa begitu saja memulai dan menghentikan instance untuk memodifikasi AMI; CloudFormation menganggap ini sebagai perubahan pada properti sumber daya yang tidak dapat diubah. Untuk membuat perubahan pada properti yang tidak dapat diubah, CloudFormation harus meluncurkan sumber daya pengganti, dalam hal ini EC2 instance Amazon baru yang menjalankan AMI baru.
Mari kita lihat bagaimana kita dapat memperbarui template stack kita untuk menggunakan Amazon Linux 2023. Perubahan utama termasuk memperbarui parameter AMI dan mengubah dari `yum` ke manajer `dnf` paket.
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
LatestAmiId:
Description: The latest Amazon Linux 2023 AMI from the Parameter Store
Type: AWS::SSM::Parameter::Value
Default: '/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64'
InstanceType:
Description: WebServer EC2 instance type
Type: String
Default: t3.micro
AllowedValues:
- t3.nano
- t3.micro
- t3.small
- t3.medium
- t3a.nano
- t3a.micro
- t3a.small
- t3a.medium
- m5.large
- m5.xlarge
- m5.2xlarge
- m5a.large
- m5a.xlarge
- m5a.2xlarge
- c5.large
- c5.xlarge
- c5.2xlarge
- r5.large
- r5.xlarge
- r5.2xlarge
- r5a.large
- r5a.xlarge
- r5a.2xlarge
ConstraintDescription: must be a valid EC2 instance type.
KeyName:
Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
Type: AWS::EC2::KeyPair::KeyName
ConstraintDescription: must be the name of an existing EC2 KeyPair.
SSHLocation:
Description: The IP address that can be used to SSH to the EC2 instances in CIDR format (e.g. 203.0.113.1/32)
Type: String
MinLength: 9
MaxLength: 18
Default: 0.0.0.0/0
AllowedPattern: '^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$'
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
Resources:
WebServerInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: !Ref LatestAmiId
InstanceType: !Ref InstanceType
KeyName: !Ref KeyName
SecurityGroupIds:
- !Ref WebServerSecurityGroup
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
# Get the latest CloudFormation package
dnf update -y aws-cfn-bootstrap
# Run cfn-init
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerInstance --region ${AWS::Region} || error_exit 'Failed to run cfn-init'
# Start up the cfn-hup daemon to listen for changes to the EC2 instance metadata
/opt/aws/bin/cfn-hup || error_exit 'Failed to start cfn-hup'
# Signal success or failure
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerInstance --region ${AWS::Region}
Metadata:
AWS::CloudFormation::Init:
config:
packages:
dnf:
httpd: []
php: []
files:
/var/www/html/index.php:
content: |
Hello World!";
echo "This is an updated version of our application.
";
echo "Running on Amazon Linux 2023!
";
?>
mode: '000644'
owner: apache
group: apache
/etc/cfn/cfn-hup.conf:
content: !Sub |
[main]
stack=${AWS::StackId}
region=${AWS::Region}
# The interval used to check for changes to the resource metadata in minutes. Default is 15
interval=2
mode: '000400'
owner: root
group: root
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
content: !Sub |
[cfn-auto-reloader-hook]
triggers=post.update
path=Resources.WebServerInstance.Metadata.AWS::CloudFormation::Init
action=/opt/aws/bin/cfn-init -s ${AWS::StackId} -r WebServerInstance --region ${AWS::Region}
runas=root
services:
systemd:
httpd:
enabled: true
ensureRunning: true
cfn-hup:
enabled: true
ensureRunning: true
files:
- /etc/cfn/cfn-hup.conf
- /etc/cfn/hooks.d/cfn-auto-reloader.conf
CreationPolicy:
ResourceSignal:
Timeout: PT5M
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80 and SSH access via port 22
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: !Ref SSHLocation
Outputs:
WebsiteURL:
Value: !Sub 'http://${WebServerInstance.PublicDnsName}'
Description: URL of the web application
```
Perbarui tumpukan menggunakan langkah yang sama seperti yang dijelaskan di[Langkah 2: Perbarui aplikasi](#update-stack-update-application).
Setelah instance baru berjalan, CloudFormation perbarui sumber daya lain di tumpukan untuk menunjuk ke sumber daya baru. Ketika semua sumber daya baru dibuat, sumber daya lama dihapus, sebuah proses yang dikenal sebagai`UPDATE_CLEANUP`. Kali ini, Anda akan melihat bahwa ID instans dan URL aplikasi dari instans di dalam tumpukan telah berubah sebagai hasil dari pembaruan. Peristiwa dalam tabel **Peristiwa** berisi deskripsi “Pembaruan yang diminta memiliki perubahan ke properti yang tidak dapat diubah dan karenanya menciptakan sumber daya fisik baru” untuk menunjukkan bahwa sumber daya diganti.
Atau: Jika Anda memiliki kode aplikasi yang ditulis ke dalam AMI yang ingin Anda perbarui, Anda dapat menggunakan mekanisme pembaruan tumpukan yang sama untuk memperbarui AMI untuk memuat aplikasi baru Anda.
**Untuk memperbarui AMI dengan kode aplikasi khusus**
1. Buat AMI baru Anda yang berisi perubahan aplikasi atau sistem operasi Anda. *Untuk informasi selengkapnya, lihat [Membuat AMI yang didukung Amazon EBS-backed di Panduan](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/creating-an-ami-ebs.html) Pengguna Amazon. EC2 *
1. Perbarui template Anda untuk memasukkan ID AMI baru.
1. Perbarui tumpukan menggunakan langkah yang sama seperti yang dijelaskan di[Langkah 2: Perbarui aplikasi](#update-stack-update-application).
Saat Anda memperbarui tumpukan, CloudFormation mendeteksi bahwa ID AMI telah berubah, dan kemudian memicu pembaruan tumpukan dengan cara yang sama seperti kami memulai yang di atas.
## Pertimbangan ketersediaan dan dampak
Properti yang berbeda memiliki dampak yang berbeda pada sumber daya dalam tumpukan. Anda dapat menggunakan CloudFormation untuk memperbarui properti apa pun; tetapi, sebelum Anda membuat perubahan, Anda harus mempertimbangkan pertanyaan-pertanyaan berikut:
1. Bagaimana pembaruan memengaruhi sumber daya itu sendiri? Misalnya, memperbarui ambang batas alarm akan membuat alarm tidak aktif selama pembaruan. Seperti yang telah kita lihat, mengubah jenis instance mengharuskan instance dihentikan dan dimulai ulang. CloudFormation menggunakan tindakan pembaruan atau modifikasi untuk sumber daya yang mendasarinya untuk membuat perubahan pada sumber daya. Untuk memahami dampak pembaruan, Anda harus memeriksa dokumentasi untuk sumber daya tertentu.
1. Apakah perubahan itu dapat berubah atau tidak dapat berubah? Beberapa perubahan pada properti sumber daya, seperti mengubah AMI di EC2 instans Amazon, tidak didukung oleh layanan yang mendasarinya. Dalam kasus perubahan yang bisa berubah, CloudFormation akan menggunakan jenis Update atau Modify APIs untuk sumber daya yang mendasarinya. Untuk perubahan properti yang tidak dapat diubah, CloudFormation akan membuat sumber daya baru dengan properti yang diperbarui dan kemudian menautkannya ke tumpukan sebelum menghapus sumber daya lama. Meskipun CloudFormation mencoba mengurangi waktu henti sumber daya tumpukan, mengganti sumber daya adalah proses multistep, dan itu akan memakan waktu. Selama konfigurasi ulang tumpukan, aplikasi Anda tidak akan beroperasi penuh. Misalnya, aplikasi mungkin tidak dapat melayani permintaan atau mengakses database.
## Sumber daya terkait
Untuk informasi selengkapnya tentang penggunaan CloudFormation untuk memulai aplikasi dan mengintegrasikan dengan layanan konfigurasi dan penyebaran lainnya seperti Puppet danOpscode Chef, lihat whitepaper berikut:
+ [Bootstrapping aplikasi melalui CloudFormation](https://s3.amazonaws.com/cloudformation-examples/BoostrappingApplicationsWithAWSCloudFormation.pdf)
+ [Integrasi dengan CloudFormation Opscode Chef](https://s3.amazonaws.com/cloudformation-examples/IntegratingAWSCloudFormationWithOpscodeChef.pdf)
+ [Integrasi dengan CloudFormation Puppet](https://s3.amazonaws.com/cloudformation-examples/IntegratingAWSCloudFormationWithPuppet.pdf)
# Buat aplikasi yang diskalakan dan diseimbangkan beban
Untuk panduan ini, Anda membuat tumpukan yang membantu Anda mengatur aplikasi yang diskalakan dan seimbang beban. Panduan ini menyediakan contoh template yang Anda gunakan untuk membuat tumpukan. Contoh template menyediakan grup Auto Scaling, Application Load Balancer, grup keamanan yang mengontrol lalu lintas ke penyeimbang beban dan ke grup Auto Scaling, dan konfigurasi notifikasi Amazon SNS untuk mempublikasikan pemberitahuan tentang aktivitas penskalaan.
Template ini membuat satu atau beberapa instans Amazon EC2 dan Application Load Balancer. Anda akan ditagih untuk sumber daya AWS yang digunakan jika Anda membuat tumpukan dari templat ini.
## Template tumpukan penuh
Mari kita mulai dengan template.
**YAML**
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
InstanceType:
Description: The EC2 instance type
Type: String
Default: t3.micro
AllowedValues:
- t3.micro
- t3.small
- t3.medium
KeyName:
Description: Name of an existing EC2 key pair to allow SSH access to the instances
Type: AWS::EC2::KeyPair::KeyName
LatestAmiId:
Description: The latest Amazon Linux 2 AMI from the Parameter Store
Type: AWS::SSM::Parameter::Value
Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
OperatorEmail:
Description: The email address to notify when there are any scaling activities
Type: String
SSHLocation:
Description: The IP address range that can be used to SSH to the EC2 instances
Type: String
MinLength: 9
MaxLength: 18
Default: 0.0.0.0/0
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
Subnets:
Type: 'List'
Description: At least two public subnets in different Availability Zones in the selected VPC
VPC:
Type: AWS::EC2::VPC::Id
Description: A virtual private cloud (VPC) that enables resources in public subnets to connect to the internet
Resources:
ELBSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: ELB Security Group
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
EC2SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: EC2 Security Group
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
SourceSecurityGroupId:
Fn::GetAtt:
- ELBSecurityGroup
- GroupId
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: !Ref SSHLocation
EC2TargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckIntervalSeconds: 30
HealthCheckProtocol: HTTP
HealthCheckTimeoutSeconds: 15
HealthyThresholdCount: 5
Matcher:
HttpCode: '200'
Name: EC2TargetGroup
Port: 80
Protocol: HTTP
TargetGroupAttributes:
- Key: deregistration_delay.timeout_seconds
Value: '20'
UnhealthyThresholdCount: 3
VpcId: !Ref VPC
ALBListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- Type: forward
TargetGroupArn: !Ref EC2TargetGroup
LoadBalancerArn: !Ref ApplicationLoadBalancer
Port: 80
Protocol: HTTP
ApplicationLoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internet-facing
Subnets: !Ref Subnets
SecurityGroups:
- !GetAtt ELBSecurityGroup.GroupId
LaunchTemplate:
Type: AWS::EC2::LaunchTemplate
Properties:
LaunchTemplateName: !Sub ${AWS::StackName}-launch-template
LaunchTemplateData:
ImageId: !Ref LatestAmiId
InstanceType: !Ref InstanceType
KeyName: !Ref KeyName
SecurityGroupIds:
- !Ref EC2SecurityGroup
UserData:
Fn::Base64: !Sub |
#!/bin/bash
yum update -y
yum install -y httpd
systemctl start httpd
systemctl enable httpd
echo "Hello World!
" > /var/www/html/index.html
NotificationTopic:
Type: AWS::SNS::Topic
Properties:
Subscription:
- Endpoint: !Ref OperatorEmail
Protocol: email
WebServerGroup:
Type: AWS::AutoScaling::AutoScalingGroup
Properties:
LaunchTemplate:
LaunchTemplateId: !Ref LaunchTemplate
Version: !GetAtt LaunchTemplate.LatestVersionNumber
MaxSize: '3'
MinSize: '1'
NotificationConfigurations:
- TopicARN: !Ref NotificationTopic
NotificationTypes: ['autoscaling:EC2_INSTANCE_LAUNCH', 'autoscaling:EC2_INSTANCE_LAUNCH_ERROR', 'autoscaling:EC2_INSTANCE_TERMINATE', 'autoscaling:EC2_INSTANCE_TERMINATE_ERROR']
TargetGroupARNs:
- !Ref EC2TargetGroup
VPCZoneIdentifier: !Ref Subnets
```
**JSON**
```
{
"AWSTemplateFormatVersion":"2010-09-09",
"Parameters":{
"InstanceType":{
"Description":"The EC2 instance type",
"Type":"String",
"Default":"t3.micro",
"AllowedValues":[
"t3.micro",
"t3.small",
"t3.medium"
]
},
"KeyName":{
"Description":"Name of an existing EC2 key pair to allow SSH access to the instances",
"Type":"AWS::EC2::KeyPair::KeyName"
},
"LatestAmiId":{
"Description":"The latest Amazon Linux 2 AMI from the Parameter Store",
"Type":"AWS::SSM::Parameter::Value",
"Default":"/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2"
},
"OperatorEmail":{
"Description":"The email address to notify when there are any scaling activities",
"Type":"String"
},
"SSHLocation":{
"Description":"The IP address range that can be used to SSH to the EC2 instances",
"Type":"String",
"MinLength":9,
"MaxLength":18,
"Default":"0.0.0.0/0",
"ConstraintDescription":"Must be a valid IP CIDR range of the form x.x.x.x/x."
},
"Subnets":{
"Type":"List",
"Description":"At least two public subnets in different Availability Zones in the selected VPC"
},
"VPC":{
"Type":"AWS::EC2::VPC::Id",
"Description":"A virtual private cloud (VPC) that enables resources in public subnets to connect to the internet"
}
},
"Resources":{
"ELBSecurityGroup":{
"Type":"AWS::EC2::SecurityGroup",
"Properties":{
"GroupDescription":"ELB Security Group",
"VpcId":{
"Ref":"VPC"
},
"SecurityGroupIngress":[
{
"IpProtocol":"tcp",
"FromPort":80,
"ToPort":80,
"CidrIp":"0.0.0.0/0"
}
]
}
},
"EC2SecurityGroup":{
"Type":"AWS::EC2::SecurityGroup",
"Properties":{
"GroupDescription":"EC2 Security Group",
"VpcId":{
"Ref":"VPC"
},
"SecurityGroupIngress":[
{
"IpProtocol":"tcp",
"FromPort":80,
"ToPort":80,
"SourceSecurityGroupId":{
"Fn::GetAtt":[
"ELBSecurityGroup",
"GroupId"
]
}
},
{
"IpProtocol":"tcp",
"FromPort":22,
"ToPort":22,
"CidrIp":{
"Ref":"SSHLocation"
}
}
]
}
},
"EC2TargetGroup":{
"Type":"AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties":{
"HealthCheckIntervalSeconds":30,
"HealthCheckProtocol":"HTTP",
"HealthCheckTimeoutSeconds":15,
"HealthyThresholdCount":5,
"Matcher":{
"HttpCode":"200"
},
"Name":"EC2TargetGroup",
"Port":80,
"Protocol":"HTTP",
"TargetGroupAttributes":[
{
"Key":"deregistration_delay.timeout_seconds",
"Value":"20"
}
],
"UnhealthyThresholdCount":3,
"VpcId":{
"Ref":"VPC"
}
}
},
"ALBListener":{
"Type":"AWS::ElasticLoadBalancingV2::Listener",
"Properties":{
"DefaultActions":[
{
"Type":"forward",
"TargetGroupArn":{
"Ref":"EC2TargetGroup"
}
}
],
"LoadBalancerArn":{
"Ref":"ApplicationLoadBalancer"
},
"Port":80,
"Protocol":"HTTP"
}
},
"ApplicationLoadBalancer":{
"Type":"AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties":{
"Scheme":"internet-facing",
"Subnets":{
"Ref":"Subnets"
},
"SecurityGroups":[
{
"Fn::GetAtt":[
"ELBSecurityGroup",
"GroupId"
]
}
]
}
},
"LaunchTemplate":{
"Type":"AWS::EC2::LaunchTemplate",
"Properties":{
"LaunchTemplateName":{
"Fn::Sub":"${AWS::StackName}-launch-template"
},
"LaunchTemplateData":{
"ImageId":{
"Ref":"LatestAmiId"
},
"InstanceType":{
"Ref":"InstanceType"
},
"KeyName":{
"Ref":"KeyName"
},
"SecurityGroupIds":[
{
"Ref":"EC2SecurityGroup"
}
],
"UserData":{
"Fn::Base64":{
"Fn::Join":[
"",
[
"#!/bin/bash\n",
"yum update -y\n",
"yum install -y httpd\n",
"systemctl start httpd\n",
"systemctl enable httpd\n",
"echo \"Hello World!
\" > /var/www/html/index.html"
]
]
}
}
}
}
},
"NotificationTopic":{
"Type":"AWS::SNS::Topic",
"Properties":{
"Subscription":[
{
"Endpoint":{
"Ref":"OperatorEmail"
},
"Protocol":"email"
}
]
}
},
"WebServerGroup":{
"Type":"AWS::AutoScaling::AutoScalingGroup",
"Properties":{
"LaunchTemplate":{
"LaunchTemplateId":{
"Ref":"LaunchTemplate"
},
"Version":{
"Fn::GetAtt":[
"LaunchTemplate",
"LatestVersionNumber"
]
}
},
"MaxSize":"3",
"MinSize":"1",
"NotificationConfigurations":[
{
"TopicARN":{
"Ref":"NotificationTopic"
},
"NotificationTypes":[
"autoscaling:EC2_INSTANCE_LAUNCH",
"autoscaling:EC2_INSTANCE_LAUNCH_ERROR",
"autoscaling:EC2_INSTANCE_TERMINATE",
"autoscaling:EC2_INSTANCE_TERMINATE_ERROR"
]
}
],
"TargetGroupARNs":[
{
"Ref":"EC2TargetGroup"
}
],
"VPCZoneIdentifier":{
"Ref":"Subnets"
}
}
}
}
}
```
## Panduan templat
Bagian pertama dari template ini menentukan. `Parameters` Setiap parameter harus diberi nilai saat runtime CloudFormation agar berhasil menyediakan tumpukan. Sumber daya yang ditentukan kemudian dalam templat mereferensikan nilai-nilai ini dan menggunakan data.
+ `InstanceType`: Jenis instans EC2 yang disediakan Amazon EC2 Auto Scaling. Jika tidak ditentukan, default dari `t3.micro` digunakan.
+ `KeyName`: Sebuah key pair EC2 yang ada untuk memungkinkan akses SSH ke instance.
+ `LatestAmiId`: Amazon Machine Image (AMI) untuk instans. Jika tidak ditentukan, instans Anda diluncurkan dengan Amazon Linux 2 AMI, menggunakan parameter AWS Systems Manager publik yang dikelola oleh AWS. Untuk informasi selengkapnya, lihat [Menemukan parameter publik](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-finding-public-parameters.html) di *Panduan AWS Systems Manager Pengguna*.
+ `OperatorEmail`: Alamat email tempat Anda ingin mengirim pemberitahuan aktivitas penskalaan.
+ `SSHLocation`: Rentang alamat IP yang dapat digunakan untuk SSH ke instance.
+ `Subnets`: Setidaknya dua subnet publik di Availability Zone yang berbeda.
+ `VPC`Virtual Private Cloud (VPC) di akun Anda yang memungkinkan sumber daya di subnet publik untuk terhubung ke internet.
**catatan**
Anda dapat menggunakan VPC default dan subnet default untuk memungkinkan instance mengakses internet. Jika menggunakan VPC Anda sendiri, pastikan bahwa ia memiliki subnet yang dipetakan ke setiap Availability Zone dari Region tempat Anda bekerja. Minimal, Anda harus memiliki dua subnet publik yang tersedia untuk membuat penyeimbang beban.
Bagian selanjutnya dari template ini menentukan. `Resources` Bagian ini menentukan sumber daya tumpukan dan propertinya.
[https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya `ELBSecurityGroup`
+ `SecurityGroupIngress`berisi aturan masuknya TCP yang memungkinkan akses dari *semua alamat IP* (” CidrIp ": “0.0.0.0/0") pada port 80.
[https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya `EC2SecurityGroup`
+ `SecurityGroupIngress`berisi dua aturan ingress: 1) aturan masuknya TCP yang memungkinkan akses SSH (port 22) dari rentang alamat IP yang Anda berikan untuk parameter `SSHLocation` input dan 2) aturan masuknya TCP yang memungkinkan akses dari penyeimbang beban dengan menentukan grup keamanan penyeimbang beban. [GetAtt](resources-section-structure.md#resource-properties-getatt)Fungsi ini digunakan untuk mendapatkan ID grup keamanan dengan nama logis`ELBSecurityGroup`.
[AWS::ElasticLoadBalancingV2::TargetGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html)sumber daya `EC2TargetGroup`
+ `Port`,`Protocol`, dan `HealthCheckProtocol` tentukan port instans EC2 (80) dan protokol (HTTP) yang digunakan lalu lintas `ApplicationLoadBalancer` rute dan Elastic Load Balancing yang digunakan untuk memeriksa kesehatan instans EC2.
+ `HealthCheckIntervalSeconds`menentukan bahwa instans EC2 memiliki interval 30 detik antara pemeriksaan kesehatan. `HealthCheckTimeoutSeconds`Ini didefinisikan sebagai lamanya waktu Elastic Load Balancing menunggu respons dari target pemeriksaan kesehatan (15 detik dalam contoh ini). Setelah periode batas waktu berlalu, Elastic Load Balancing menandai bahwa pemeriksaan kesehatan instans EC2 tidak sehat. Ketika instans EC2 gagal tiga pemeriksaan kesehatan berturut-turut (`UnhealthyThresholdCount`), Elastic Load Balancing menghentikan perutean lalu lintas ke instans EC2 tersebut hingga instance tersebut memiliki lima pemeriksaan kesehatan sehat berturut-turut (). `HealthyThresholdCount` Pada saat itu, Elastic Load Balancing menganggap instance sehat dan mulai merutekan lalu lintas ke instance lagi.
+ `TargetGroupAttributes`memperbarui nilai penundaan deregistrasi grup target menjadi 20 detik. Secara default, Elastic Load Balancing menunggu 300 detik sebelum menyelesaikan proses deregistrasi.
[AWS::ElasticLoadBalancingV2::Listener](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html)sumber daya `ALBListener`
+ `DefaultActions`menentukan port yang didengarkan penyeimbang beban, grup target tempat penyeimbang beban meneruskan permintaan, dan protokol yang digunakan untuk merutekan permintaan.
[AWS::ElasticLoadBalancingV2::LoadBalancer](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-loadbalancer.html)sumber daya `ApplicationLoadBalancer`
+ `Subnets`mengambil nilai parameter `Subnets` input sebagai daftar subnet publik di mana node penyeimbang beban akan dibuat.
+ `SecurityGroup`mendapatkan ID grup keamanan yang bertindak sebagai firewall virtual untuk node penyeimbang beban Anda untuk mengontrol lalu lintas masuk. [GetAtt](resources-section-structure.md#resource-properties-getatt)Fungsi ini digunakan untuk mendapatkan ID grup keamanan dengan nama logis`ELBSecurityGroup`.
[AWS::EC2::LaunchTemplate](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya `LaunchTemplate`
+ `ImageId`mengambil nilai parameter `LatestAmiId` input sebagai AMI untuk digunakan.
+ `KeyName`mengambil nilai parameter `KeyName` input sebagai key pair EC2 untuk digunakan.
+ `SecurityGroupIds`mendapatkan ID grup keamanan dengan nama logis `EC2SecurityGroup` yang bertindak sebagai firewall virtual untuk instans EC2 Anda untuk mengontrol lalu lintas masuk.
+ `UserData`adalah skrip konfigurasi yang berjalan setelah instance aktif dan berjalan. Dalam contoh ini, skrip menginstal Apache dan membuat file index.html.
[AWS::SNS::Topic](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html)sumber daya `NotificationTopic`
+ `Subscription`mengambil nilai parameter `OperatorEmail` input sebagai alamat email untuk penerima notifikasi ketika ada aktivitas penskalaan.
AWS::AutoScaling::AutoScalingSumber daya [grup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html) `WebServerGroup`
+ `MinSize`dan `MaxSize` atur jumlah minimum dan maksimum instans EC2 di grup Auto Scaling.
+ `TargetGroupARNs`mengambil ARN dari kelompok target dengan nama logis. `EC2TargetGroup` Saat grup Auto Scaling ini menskalakan, grup Auto Scaling secara otomatis mendaftarkan dan membatalkan pendaftaran instance dengan grup target ini.
+ `VPCZoneIdentifier`mengambil nilai parameter `Subnets` input sebagai daftar subnet publik tempat instans EC2 dapat dibuat.
## Langkah 1: Luncurkan tumpukan
Sebelum Anda meluncurkan tumpukan, periksa apakah Anda memiliki izin AWS Identity and Access Management (IAM) untuk menggunakan semua layanan berikut: Amazon EC2, Amazon EC2 Auto Scaling,, Elastic Load Balancing AWS Systems Manager, Amazon SNS, dan. CloudFormation
Prosedur berikut melibatkan mengunggah template tumpukan sampel dari file. Buka editor teks di mesin lokal Anda dan tambahkan salah satu templat. Simpan file dengan nama`sampleloadbalancedappstack.template`.
**Untuk meluncurkan template tumpukan**
1. Masuk ke Konsol Manajemen AWS dan buka CloudFormation konsol di [https://console.aws.amazon.com/cloudformation](https://console.aws.amazon.com/cloudformation/).
1. Pilih **Buat tumpukan**, **Dengan sumber daya baru (standar)**.
1. Di bawah **Tentukan templat**, pilih **Unggah file templat**, **Pilih file** untuk mengunggah `sampleloadbalancedappstack.template` file.
1. Pilih **Berikutnya**.
1. Pada halaman **Tentukan detail tumpukan**, ketik nama tumpukan (misalnya,**SampleLoadBalancedAppStack**).
1. **Di bawah **Parameter**, tinjau parameter untuk tumpukan dan berikan nilai untuk semua parameter yang tidak memiliki nilai default, termasuk **OperatorEmail**,, **SSHLocation**KeyName****, **VPC**, dan Subnet.**
1. Pilih **Selanjutnya** dua kali.
1. Pada halaman **Ulasan**, tinjau dan konfirmasikan pengaturan.
1. Pilih **Kirim**.
Anda dapat melihat status tumpukan di CloudFormation konsol di kolom **Status**. Ketika CloudFormation telah berhasil membuat tumpukan, Anda menerima status **CREATE\$1COMPLETE**.
**catatan**
Setelah Anda membuat tumpukan, Anda harus mengonfirmasi langganan sebelum alamat email dapat mulai menerima pemberitahuan. Untuk informasi selengkapnya, lihat [Mendapatkan notifikasi Amazon SNS saat grup Auto Scaling Anda menskalakan](https://docs.aws.amazon.com/autoscaling/ec2/userguide/ec2-auto-scaling-sns-notifications.html) di Panduan Pengguna *Amazon EC2 Auto Scaling*.
## Langkah 2: Bersihkan sumber daya sampel Anda
Untuk memastikan bahwa Anda tidak dikenakan biaya untuk sumber daya sampel yang tidak digunakan, hapus tumpukan.
**Untuk menghapus tumpukan**
1. Di CloudFormation konsol, pilih **SampleLoadBalancedAppStack**tumpukan.
1. Pilih **Hapus**.
1. Dalam pesan konfirmasi, pilih **Hapus tumpukan**.
Status **SampleLoadBalancedAppStack**perubahan pada **DELETE\$1IN\$1PROGRESS**. Ketika CloudFormation menyelesaikan penghapusan tumpukan, itu menghapus tumpukan dari daftar.
Gunakan contoh template dari panduan ini untuk membangun template tumpukan Anda sendiri. Untuk informasi selengkapnya, lihat [Tutorial: Menyiapkan aplikasi yang diskalakan dan seimbang beban di Panduan Pengguna](https://docs.aws.amazon.com/autoscaling/ec2/userguide/tutorial-ec2-auto-scaling-load-balancer.html) *Amazon EC2 Auto Scaling*.
# Rekan dengan VPC di yang lain Akun AWS
Anda dapat mengintip dengan Virtual Private Cloud (VPC) di tempat lain dengan menggunakan. Akun AWS [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpcpeeringconnection.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpcpeeringconnection.html) Ini menciptakan koneksi jaringan antara dua VPCs yang memungkinkan Anda untuk mengarahkan lalu lintas di antara mereka sehingga mereka dapat berkomunikasi seolah-olah mereka berada dalam jaringan yang sama. Koneksi peering VPC dapat membantu memfasilitasi akses data dan transfer data.
Untuk membuat koneksi peering VPC, Anda perlu mengotorisasi dua terpisah Akun AWS dalam satu tumpukan. CloudFormation
Untuk informasi selengkapnya tentang peering VPC dan batasannya, lihat Panduan Peering [VPC](https://docs.aws.amazon.com/vpc/latest/peering/) Amazon.
## Prasyarat
1. Anda memerlukan ID VPC peer, ID Akun AWS rekan, dan peran [akses lintas akun untuk](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) koneksi peering.
**catatan**
Panduan ini mengacu pada dua akun: Pertama adalah akun yang memungkinkan peering lintas akun (*akun penerima*). Kedua adalah akun yang meminta koneksi peering (*akun peminta*).
1. Untuk menerima koneksi peering VPC, peran akses lintas-akun harus dapat Anda tanggung. Sumber daya berperilaku dengan cara yang sama seperti sumber daya koneksi peering VPC di akun yang sama. *Untuk informasi tentang cara administrator IAM memberikan izin untuk mengambil peran lintas akun, lihat [Memberikan izin pengguna untuk beralih peran dalam Panduan Pengguna](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html) IAM.*
## Langkah 1: Buat VPC dan peran lintas akun
Di langkah ini, Anda akan membuat VPC dan peran dalam *akun penerima*.
**Untuk membuat VPC dan peran akses lintas akun**
1. Masuk ke Konsol Manajemen AWS dan buka CloudFormation konsol di [https://console.aws.amazon.com/cloudformation](https://console.aws.amazon.com/cloudformation/).
1. Dari halaman **Stacks**, pilih **Buat tumpukan** di kanan atas, lalu pilih **Dengan sumber daya baru (standar)**.
1. **Untuk **Prasyarat - Siapkan templat**, pilih **Pilih templat yang ada** lalu **Unggah file templat, Pilih file**.**
1. Buka editor teks di mesin lokal Anda dan tambahkan salah satu templat berikut. Simpan file dan kembali ke konsol untuk memilihnya sebagai file template.
**Example JSON**
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Create a VPC and an assumable role for cross account VPC peering.",
"Parameters": {
"PeerRequesterAccountId": {
"Type": "String"
}
},
"Resources": {
"vpc": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.1.0.0/16",
"EnableDnsSupport": false,
"EnableDnsHostnames": false,
"InstanceTenancy": "default"
}
},
"peerRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Principal": {
"AWS": {
"Ref": "PeerRequesterAccountId"
}
},
"Action": [
"sts:AssumeRole"
],
"Effect": "Allow"
}
]
},
"Path": "/",
"Policies": [
{
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "ec2:AcceptVpcPeeringConnection",
"Resource": "*"
}
]
}
}
]
}
}
},
"Outputs": {
"VPCId": {
"Value": {
"Ref": "vpc"
}
},
"RoleARN": {
"Value": {
"Fn::GetAtt": [
"peerRole",
"Arn"
]
}
}
}
}
```
**Example YAML**
```
AWSTemplateFormatVersion: 2010-09-09
Description: Create a VPC and an assumable role for cross account VPC peering.
Parameters:
PeerRequesterAccountId:
Type: String
Resources:
vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.1.0.0/16
EnableDnsSupport: false
EnableDnsHostnames: false
InstanceTenancy: default
peerRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Principal:
AWS: !Ref PeerRequesterAccountId
Action:
- 'sts:AssumeRole'
Effect: Allow
Path: /
Policies:
- PolicyName: root
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action: 'ec2:AcceptVpcPeeringConnection'
Resource: '*'
Outputs:
VPCId:
Value: !Ref vpc
RoleARN:
Value: !GetAtt
- peerRole
- Arn
```
1. Pilih **Berikutnya**.
1. Beri nama tumpukan (misalnya,**VPC-owner**), lalu masukkan Akun AWS ID *akun pemohon* di **PeerRequesterAccountId**bidang.
1. Terima default, dan kemudian pilih **Selanjutnya**.
1. Pilih **Saya mengakui yang CloudFormation mungkin membuat sumber daya IAM**, lalu pilih **Buat** tumpukan.
## Langkah 2: Buat templat yang mencakup `AWS::EC2::VPCPeeringConnection`
*Sekarang setelah Anda membuat VPC dan peran lintas akun, Anda dapat mengintip VPC menggunakan yang lain Akun AWS (akun pemohon).*
**Untuk membuat template yang menyertakan sumber daya [AWS: :EC2:: VPCPeering](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpcpeeringconnection.html) Connection**
1. Kembali ke halaman beranda CloudFormation konsol.
1. Dari halaman **Stacks**, pilih **Buat tumpukan** di kanan atas, lalu pilih **Dengan sumber daya baru (standar)**.
1. **Untuk **Prasyarat - Siapkan templat**, pilih **Pilih templat yang ada** lalu **Unggah file templat, Pilih file**.**
1. Buka editor teks di mesin lokal Anda dan tambahkan salah satu templat berikut. Simpan file dan kembali ke konsol untuk memilihnya sebagai file template.
**Example JSON**
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Create a VPC and a VPC Peering connection using the PeerRole to accept.",
"Parameters": {
"PeerVPCAccountId": {
"Type": "String"
},
"PeerVPCId": {
"Type": "String"
},
"PeerRoleArn": {
"Type": "String"
}
},
"Resources": {
"vpc": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.2.0.0/16",
"EnableDnsSupport": false,
"EnableDnsHostnames": false,
"InstanceTenancy": "default"
}
},
"vpcPeeringConnection": {
"Type": "AWS::EC2::VPCPeeringConnection",
"Properties": {
"VpcId": {
"Ref": "vpc"
},
"PeerVpcId": {
"Ref": "PeerVPCId"
},
"PeerOwnerId": {
"Ref": "PeerVPCAccountId"
},
"PeerRoleArn": {
"Ref": "PeerRoleArn"
}
}
}
},
"Outputs": {
"VPCId": {
"Value": {
"Ref": "vpc"
}
},
"VPCPeeringConnectionId": {
"Value": {
"Ref": "vpcPeeringConnection"
}
}
}
}
```
**Example YAML**
```
AWSTemplateFormatVersion: 2010-09-09
Description: Create a VPC and a VPC Peering connection using the PeerRole to accept.
Parameters:
PeerVPCAccountId:
Type: String
PeerVPCId:
Type: String
PeerRoleArn:
Type: String
Resources:
vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.2.0.0/16
EnableDnsSupport: false
EnableDnsHostnames: false
InstanceTenancy: default
vpcPeeringConnection:
Type: AWS::EC2::VPCPeeringConnection
Properties:
VpcId: !Ref vpc
PeerVpcId: !Ref PeerVPCId
PeerOwnerId: !Ref PeerVPCAccountId
PeerRoleArn: !Ref PeerRoleArn
Outputs:
VPCId:
Value: !Ref vpc
VPCPeeringConnectionId:
Value: !Ref vpcPeeringConnection
```
1. Pilih **Berikutnya**.
1. Beri nama tumpukan (misalnya, **VPC-peering-connection**).
1. Terima default, dan kemudian pilih **Selanjutnya**.
1. Pilih **Saya mengakui yang CloudFormation mungkin membuat sumber daya IAM**, lalu pilih **Buat** tumpukan.
## Buat template dengan kebijakan yang sangat ketat
Anda mungkin ingin membuat kebijakan yang sangat ketat untuk mengintip VPC Anda dengan yang lain. Akun AWS
Contoh templat berikut menunjukkan bagaimana mengubah templat pemilik peer VPC (*akun penerima* yang dibuat di Langkah 1 di atas) sehingga lebih ketat.
**Example JSON**
```
{
"AWSTemplateFormatVersion":"2010-09-09",
"Description":"Create a VPC and an assumable role for cross account VPC peering.",
"Parameters":{
"PeerRequesterAccountId":{
"Type":"String"
}
},
"Resources":{
"peerRole":{
"Type":"AWS::IAM::Role",
"Properties":{
"AssumeRolePolicyDocument":{
"Statement":[
{
"Action":[
"sts:AssumeRole"
],
"Effect":"Allow",
"Principal":{
"AWS":{
"Ref":"PeerRequesterAccountId"
}
}
}
]
},
"Path":"/",
"Policies":[
{
"PolicyDocument":{
"Statement":[
{
"Action":"ec2:acceptVpcPeeringConnection",
"Effect":"Allow",
"Resource":{
"Fn::Sub":"arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}"
}
},
{
"Action":"ec2:acceptVpcPeeringConnection",
"Condition":{
"StringEquals":{
"ec2:AccepterVpc":{
"Fn::Sub":"arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}"
}
}
},
"Effect":"Allow",
"Resource":{
"Fn::Sub":"arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc-peering-connection/*"
}
}
],
"Version":"2012-10-17"
},
"PolicyName":"root"
}
]
}
},
"vpc":{
"Type":"AWS::EC2::VPC",
"Properties":{
"CidrBlock":"10.1.0.0/16",
"EnableDnsHostnames":false,
"EnableDnsSupport":false,
"InstanceTenancy":"default"
}
}
},
"Outputs":{
"RoleARN":{
"Value":{
"Fn::GetAtt":[
"peerRole",
"Arn"
]
}
},
"VPCId":{
"Value":{
"Ref":"vpc"
}
}
}
}
```
**Example YAML**
```
AWSTemplateFormatVersion: 2010-09-09
Description: Create a VPC and an assumable role for cross account VPC peering.
Parameters:
PeerRequesterAccountId:
Type: String
Resources:
peerRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action:
- 'sts:AssumeRole'
Effect: Allow
Principal:
AWS:
Ref: PeerRequesterAccountId
Path: /
Policies:
- PolicyDocument:
Statement:
- Action: 'ec2:acceptVpcPeeringConnection'
Effect: Allow
Resource:
'Fn::Sub': 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}'
- Action: 'ec2:acceptVpcPeeringConnection'
Condition:
StringEquals:
'ec2:AccepterVpc':
'Fn::Sub': 'arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc/${vpc}'
Effect: Allow
Resource:
'Fn::Sub': >-
arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:vpc-peering-connection/*
Version: 2012-10-17
PolicyName: root
vpc:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.1.0.0/16
EnableDnsHostnames: false
EnableDnsSupport: false
InstanceTenancy: default
Outputs:
RoleARN:
Value:
'Fn::GetAtt':
- peerRole
- Arn
VPCId:
Value:
Ref: vpc
```
Untuk mengakses VPC, Anda dapat menggunakan templat peminta yang sama seperti pada Langkah 2 di atas.
Untuk informasi selengkapnya, lihat [Identitas dan manajemen akses untuk mengintip VPC di Panduan Peering](https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html) *VPC* Amazon.
# Lakukan blue/green penyebaran ECS melalui penggunaan CodeDeploy CloudFormation
Untuk memperbarui aplikasi yang berjalan di Amazon Elastic Container Service (Amazon ECS), Anda dapat menggunakan CodeDeploy strategi penyebaran biru/hijau. Strategi ini membantu meminimalkan gangguan yang disebabkan oleh perubahan versi aplikasi.
Dalam blue/green penerapan, Anda membuat lingkungan aplikasi baru (disebut *hijau*) di samping lingkungan hidup Anda saat ini (disebut sebagai *biru*). Ini memungkinkan Anda untuk memantau dan menguji lingkungan hijau sebelum merutekan lalu lintas langsung dari lingkungan biru ke lingkungan hijau. Setelah lingkungan hijau melayani lalu lintas langsung, Anda dapat dengan aman menghentikan lingkungan biru.
Untuk melakukan penerapan CodeDeploy biru/hijau pada ECS menggunakan CloudFormation, Anda menyertakan informasi berikut dalam template tumpukan Anda:
+ `Hooks`Bagian yang menggambarkan `AWS::CodeDeploy::BlueGreen` kail.
+ `Transform`Bagian yang menentukan `AWS::CodeDeployBlueGreen` transformasi.
Topik berikut memandu Anda melalui pengaturan CloudFormation template untuk penyebaran biru/hijau di ECS.
**Topics**
+ [Tentang blue/green penerapan](about-blue-green-deployments.md)
+ [Pertimbangan saat mengelola penerapan ECS menggunakan blue/green CloudFormation](blue-green-considerations.md)
+ [`AWS::CodeDeploy::BlueGreen`sintaks hook](blue-green-hook-syntax.md)
+ [Contoh template penerapan biru/hijau](blue-green-template-example.md)
# Tentang blue/green penerapan
Topik ini memberikan ikhtisar tentang cara melakukan blue/green penerapan dengan CloudFormation pekerjaan. Ini juga menjelaskan bagaimana mempersiapkan CloudFormation template Anda untuk penerapan biru/hijau.
**Topics**
+ [Cara kerjanya](#blue-green-how-it-works)
+ [Pembaruan sumber daya yang memulai penerapan hijau](#blue-green-resources)
+ [Menyiapkantemplat](#blue-green-setup)
+ [Memodelkan blue/green penerapan Anda](#blue-green-required)
+ [Set perubahan](#blue-green-changesets)
+ [Memantau peristiwa tumpukan](#blue-green-events)
+ [Izin IAM](#blue-green-iam)
## Cara kerjanya
Saat menggunakan CloudFormation untuk melakukan blue/green penerapan ECS CodeDeploy, Anda mulai dengan membuat template tumpukan yang menentukan sumber daya untuk lingkungan aplikasi biru dan hijau Anda, termasuk menentukan pengaturan perutean lalu lintas dan stabilisasi yang akan digunakan. Selanjutnya, Anda membuat tumpukan dari template itu. Ini menghasilkan aplikasi biru (saat ini) Anda. CloudFormation hanya membuat sumber daya biru selama pembuatan tumpukan. Sumber daya untuk deployment hijau tidak dibuat hingga diperlukan.
Kemudian, jika di update stack future Anda memperbarui definisi tugas atau sumber daya set tugas dalam aplikasi biru Anda, CloudFormation lakukan hal berikut:
+ Menghasilkan semua sumber daya lingkungan aplikasi hijau yang diperlukan
+ Menggeser lalu lintas berdasarkan parameter perutean lalu lintas yang ditentukan
+ Menghapus sumber daya biru
Jika kesalahan terjadi pada titik mana pun sebelum deployment hijau berhasil dan diselesaikan, CloudFormation menggulung tumpukan kembali ke statusnya sebelum seluruh deployment hijau dimulai.
## Pembaruan sumber daya yang memulai penerapan hijau
Saat Anda melakukan pembaruan tumpukan yang memperbarui properti tertentu dari sumber daya ECS tertentu, CloudFormation memulai proses penerapan hijau. Sumber daya yang memulai proses ini adalah:
+ [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html)
+ [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskset.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskset.html)
Namun, jika pembaruan sumber daya ini tidak melibatkan perubahan properti yang memerlukan penggantian, penerapan hijau tidak akan dimulai. Untuk informasi selengkapnya, lihat [Memahami perilaku pembaruan sumber daya tumpukan](using-cfn-updating-stacks-update-behaviors.md).
Penting untuk dicatat bahwa Anda tidak dapat menggabungkan pembaruan ke sumber daya di atas dengan pembaruan ke sumber daya lain dalam operasi pembaruan tumpukan yang sama. Jika Anda perlu memperbarui sumber daya yang terdaftar dan sumber daya lain dalam tumpukan yang sama, Anda memiliki dua opsi:
+ Lakukan dua operasi pembaruan tumpukan terpisah: satu yang hanya mencakup pembaruan ke sumber daya di atas, dan pembaruan tumpukan terpisah yang mencakup perubahan pada sumber daya lainnya.
+ Hapus `Transform` dan `Hooks` bagian dari templat Anda dan kemudian lakukan pembaruan tumpukan. Dalam hal ini, CloudFormation tidak akan melakukan penerapan hijau.
## Mempersiapkan template Anda untuk melakukan penyebaran ECS blue/green
Untuk mengaktifkan blue/green penerapan pada tumpukan Anda, sertakan bagian berikut dalam template tumpukan Anda sebelum melakukan pembaruan tumpukan.
+ Tambahkan referensi ke `AWS::CodeDeployBlueGreen` ubah ke templat anda:
```
"Transform": [
"AWS::CodeDeployBlueGreen"
],
```
+ Tambahkan `Hooks` bagian yang menjalankan `AWS::CodeDeploy::BlueGreen` dan menentukan properti untuk deployment Anda. Untuk informasi selengkapnya, lihat [`AWS::CodeDeploy::BlueGreen`sintaks hook](blue-green-hook-syntax.md).
+ Di bagian `Resources`, tentukan sumber daya biru dan hijau untuk deployment Anda.
Anda dapat menambahkan bagian ini ketika pertama kali membuat templat (yaitu, sebelum membuat tumpukan itu sendiri), atau Anda dapat menambahkannya ke templat yang ada sebelum melakukan pembaruan tumpukan. Jika Anda menentukan blue/green penerapan untuk tumpukan baru, CloudFormation hanya membuat sumber daya biru selama pembuatan tumpukan — sumber daya untuk penerapan hijau tidak dibuat sampai diperlukan selama pembaruan tumpukan.
## Memodelkan blue/green penerapan Anda menggunakan sumber daya CloudFormation
Untuk melakukan penerapan CodeDeploy biru/hijau di ECS, CloudFormation template Anda harus menyertakan sumber daya yang memodelkan penerapan Anda, seperti layanan Amazon ECS dan penyeimbang beban. Untuk rincian lebih lanjut tentang apa yang diwakili sumber daya ini, lihat [Sebelum Anda memulai deployment Amazon ECS](https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-steps-ecs.html#deployment-steps-prerequisites-ecs) dalam *AWS CodeDeploy Panduan Pengguna*.
| Persyaratan | Sumber daya | Diperlukan/Opsional | Memulai blue/green penerapan jika diganti? |
| --- | --- | --- | --- |
| Kluster Amazon ECS | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-cluster.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-cluster.html) | Tidak wajib. Klaster default dapat digunakan. | Tidak |
| Layanan Amazon ECS | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.html) | Wajib. | Tidak |
| Penyeimbang Beban Jaringan atau Aplikasi | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-service-loadbalancer.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-service-loadbalancer.html) | Wajib. | Tidak |
| Listener produksi | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html) | Wajib. | Tidak |
| Uji listener | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-listener.html) | Tidak wajib. | Tidak |
| Dua grup target | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html) | Wajib. | Tidak |
| Definisi tugas Amazon ECS | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html) | Wajib. | Ya |
| Wadah untuk aplikasi Amazon ECS Anda | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-containerdefinition.html#cfn-ecs-taskdefinition-containerdefinition-name](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-containerdefinition.html#cfn-ecs-taskdefinition-containerdefinition-name) | Wajib. | Tidak |
| Port untuk set tugas pengganti Anda | [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-portmapping.html#cfn-ecs-taskdefinition-portmapping-containerport](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-ecs-taskdefinition-portmapping.html#cfn-ecs-taskdefinition-portmapping-containerport) | Wajib. | Tidak |
## Set perubahan
Kami sangat menyarankan Anda utnuk membuat perubahan yang ditetapkan sebelum melakukan pembaruan tumpukan yang akan memulai deployment hijau. Ini memungkinkan Anda untuk melihat perubahan aktual yang akan dilakukan pada tumpukan Anda sebelum melakukan pembaruan tumpukan. Sadarilah bahwa perubahan sumber daya mungkin tidak tercantum dalam urutan yang akan dilakukan selama pembaruan tumpukan. Untuk informasi selengkapnya, lihat [Perbarui CloudFormation tumpukan menggunakan set perubahan](using-cfn-updating-stacks-changesets.md).
## Memantau peristiwa tumpukan
Anda dapat melihat peristiwa tumpukan yang dihasilkan pada setiap langkah deployment ECS pada tab **Peristiwa** dari halamn **Tumpukan**, dan menggunakan AWS CLI. Untuk informasi selengkapnya, lihat [Pantau kemajuan tumpukan](monitor-stack-progress.md).
## Izin IAM untuk penerapan blue/green
Agar berhasil CloudFormation melakukan penerapan biru-hijau, Anda harus memiliki izin berikut: CodeDeploy
+ `codedeploy:Get*`
+ `codedeploy:CreateCloudFormationDeployment`
Untuk informasi selengkapnya, lihat [Kunci tindakan, sumber daya, dan kondisi CodeDeploy](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscodedeploy.html) di *Referensi Otorisasi Layanan*.
# Pertimbangan saat mengelola penerapan ECS menggunakan blue/green CloudFormation
Proses penggunaan CloudFormation untuk melakukan penyebaran ECS Anda berbeda dari blue/green penerapan CodeDeploy ECS standar yang hanya menggunakan. CodeDeploy *Untuk pemahaman mendetail tentang perbedaan-perbedaan ini, lihat [Perbedaan antara blue/green penerapan Amazon ECS melalui CodeDeploy dan CloudFormation di Panduan](https://docs.aws.amazon.com/codedeploy/latest/userguide/deployments-create-ecs-cfn.html#differences-ecs-bg-cfn) Pengguna.AWS CodeDeploy *
Saat mengelola blue/green penerapan Anda menggunakan CloudFormation, ada batasan dan pertimbangan tertentu yang perlu diingat:
+ Hanya pembaruan ke sumber daya tertentu yang akan memulai penerapan hijau. Untuk informasi selengkapnya, lihat [Pembaruan sumber daya yang memulai penerapan hijau](about-blue-green-deployments.md#blue-green-resources).
+ Anda tidak dapat menyertakan pembaruan ke sumber daya yang memulai penerapan hijau dan pembaruan ke sumber daya lain dalam pembaruan tumpukan yang sama. Untuk informasi selengkapnya, lihat [Pembaruan sumber daya yang memulai penerapan hijau](about-blue-green-deployments.md#blue-green-resources).
+ Anda hanya dapat menentukan layanan ECS tunggal sebagai target deployment.
+ Parameter yang nilainya dikaburkan oleh tidak CloudFormation dapat diperbarui CodeDeploy selama penerapan hijau, dan akan menyebabkan kesalahan dan kegagalan pembaruan tumpukan. Ini termasuk:
+ Parameter didefinisikan dengan `NoEcho` atribut.
+ Parameter yang menggunakan referensi dinamis untuk mengambil nilai-nilainya dari layanan eksternal. Untuk informasi selengkapnya tentang referensi dinamis, lihat[Dapatkan nilai yang disimpan di layanan lain menggunakan referensi dinamis](dynamic-references.md).
+ Untuk membatalkan penerapan hijau yang masih berlangsung, batalkan pembaruan tumpukan di CloudFormation, bukan CodeDeploy atau ECS. Untuk informasi selengkapnya, lihat [Batalkan pembaruan tumpukan](using-cfn-stack-update-cancel.md). Setelah pembaruan selesai, Anda tidak dapat membatalkannya. Namun, Anda dapat memperbarui tumpukan lagi dengan pengaturan sebelumnya.
+ CloudFormation Fitur-fitur berikut saat ini tidak didukung untuk template yang menentukan blue/green penerapan ECS:
+ Mendeklarasikan [output](outputs-section-structure.md) atau menggunakan [Fn:: ImportValue](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-importvalue.html) untuk mengimpor nilai dari tumpukan lain.
+ Mengimpor sumber daya. Untuk informasi selengkapnya tentang mengimpor sumber daya, lihat[Impor AWS sumber daya ke CloudFormation tumpukan](import-resources.md).
+ Menggunakan `AWS::CodeDeploy::BlueGreen` hook dalam template yang menyertakan sumber daya tumpukan bersarang. Untuk informasi lebih lanjut tentang tumpukan bersarang, lihat. [Pisahkan template menjadi potongan-potongan yang dapat digunakan kembali menggunakan tumpukan bersarang](using-cfn-nested-stacks.md)
+ Menggunakan `AWS::CodeDeploy::BlueGreen` hook di tumpukan bersarang.
# `AWS::CodeDeploy::BlueGreen`sintaks hook
Sintaks berikut menjelaskan struktur `AWS::CodeDeploy::BlueGreen` hook untuk penyebaran ECS. blue/green
## Sintaksis
```
"Hooks": {
"Logical ID": {
"Type": "AWS::CodeDeploy::BlueGreen",
"Properties": {
"TrafficRoutingConfig": {
"Type": "Traffic routing type",
"TimeBasedCanary": {
"StepPercentage": Integer,
"BakeTimeMins": Integer
},
"TimeBasedLinear": {
"StepPercentage": Integer,
"BakeTimeMins": Integer
}
},
"AdditionalOptions": {"TerminationWaitTimeInMinutes": Integer},
"LifecycleEventHooks": {
"BeforeInstall": "FunctionName",
"AfterInstall": "FunctionName",
"AfterAllowTestTraffic": "FunctionName",
"BeforeAllowTraffic": "FunctionName",
"AfterAllowTraffic": "FunctionName"
},
"ServiceRole": "CodeDeployServiceRoleName",
"Applications": [
{
"Target": {
"Type": "AWS::ECS::Service",
"LogicalID": "Logical ID of AWS::ECS::Service"
},
"ECSAttributes": {
"TaskDefinitions": [
"Logical ID of AWS::ECS::TaskDefinition (Blue)",
"Logical ID of AWS::ECS::TaskDefinition (Green)"
],
"TaskSets": [
"Logical ID of AWS::ECS::TaskSet (Blue)",
"Logical ID of AWS::ECS::TaskSet (Green)"
],
"TrafficRouting": {
"ProdTrafficRoute": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"LogicalID": "Logical ID of AWS::ElasticLoadBalancingV2::Listener (Production)"
},
"TestTrafficRoute": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"LogicalID": "Logical ID of AWS::ElasticLoadBalancingV2::Listener (Test)"
},
"TargetGroups": [
"Logical ID of AWS::ElasticLoadBalancingV2::TargetGroup (Blue)",
"Logical ID of AWS::ElasticLoadBalancingV2::TargetGroup (Green)"
]
}
}
}
]
}
}
}
```
## Sifat-sifat
Logical ID (juga disebut *nama logis*)
ID logis dari hook dideklarasikan di `Hooks` bagian template. ID logis harus berupa alfanumerik (A-Za-z0-9) dan unik dalam templat.
*Wajib*: Ya
`Type`
Jenis kait. `AWS::CodeDeploy::BlueGreen`
*Wajib*: Ya
`Properties`
Properti kait.
*Wajib*: Ya
`TrafficRoutingConfig`
Pengaturan konfigurasi perutean lalu lintas.
*Wajib*: Tidak
Konfigurasi default adalah pergeseran lalu lintas Canary berbasis waktu, dengan persentase langkah 15% dan waktu menanam lima menit.
`Type`
Jenis pergeseran lalu lintas yang digunakan oleh konfigurasi deployment.
Nilai yang valid: AllAtOnce \$1 TimeBasedCanary \$1 TimeBasedLinear
*Wajib*: Ya
`TimeBasedCanary`
Menentukan konfigurasi yang menggeser lalu lintas dari satu versi deployment ke versi lain dalam dua tambahan.
*Wajib*: Bersyarat: Jika Anda menentukan `TimeBasedCanary` sebagai jenis perutean lalu lintas, Anda harus menyertakan parameter. `TimeBasedCanary`
`StepPercentage`
Persentase lalu lintas bergeser dalam tambahan pertama `TimeBasedCanary` deployment. Persentase langkah harus 14% atau lebih besar.
*Wajib*: Tidak
`BakeTimeMins`
Jumlah menit antara pergeseran lalu lintas pertama dan kedua dari `TimeBasedCanary` deployment.
*Wajib*: Tidak
`TimeBasedLinear`
Menentukan konfigurasi yang menggeser lalu lintas dari satu versi deployment ke versi lain dalam dua tambahan, dengan jumlah menit yang sama antara setiap tambahan.
*Wajib*: Bersyarat: Jika Anda menentukan `TimeBasedLinear` sebagai jenis perutean lalu lintas, Anda harus menyertakan parameter. `TimeBasedLinear`
`StepPercentage`
Persentase lalu lintas yang bergeser pada awal setiap tambahan `TimeBasedLinear` deployment. Persentase langkah harus 14% atau lebih besar.
*Wajib*: Tidak
`BakeTimeMins`
Jumlah menit antara setiap pergeseran lalu lintas tambahan `TimeBasedLinear` deployment.
*Wajib*: Tidak
`AdditionalOptions`
Opsi tambahan untuk blue/green penyebaran.
*Wajib*: Tidak
`TerminationWaitTimeInMinutes`
Menentukan waktu tunggu, dalam hitungan menit, sebelum mengakhiri sumber daya biru.
*Wajib*: Tidak
`LifecycleEventHooks`
Gunakan kait peristiwa siklus hidup untuk menentukan fungsi Lambda yang CodeDeploy dapat memanggil untuk memvalidasi penerapan. Anda dapat menggunakan fungsi yang sama atau yang berbeda untuk peristiwa deployment siklus hidup. Setelah menyelesaikan tes validasi, fungsi `AfterAllowTraffic` Lambda memanggil CodeDeploy kembali dan memberikan hasil dari atau. `Succeeded` `Failed` Untuk informasi selengkapnya, lihat [bagian AppSpec 'kait'](https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html) di *Panduan AWS CodeDeploy Pengguna*.
*Wajib*: Tidak
`BeforeInstall`
Fungsi yang digunakan untuk menjalankan tugas sebelum set tugas pengganti dibuat.
*Wajib*: Tidak
`AfterInstall`
Fungsi yang digunakan untuk menjalankan tugas setelah set tugas pengganti dibuat dan salah satu grup target terkait dengan itu.
*Wajib*: Tidak
`AfterAllowTestTraffic`
Fungsi yang diigunakan untuk menjalankan tugas setelah listener tes melayani lalu lintas ke set tugas pengganti.
*Wajib*: Tidak
`BeforeAllowTraffic`
Fungsi yang digunakan untuk menjalankan tugas setelah grup target kedua dikaitkan dengan set tugas pengganti, tapi sebelum lalu lintas bergeser ke set tugas pengganti.
*Wajib*: Tidak
`AfterAllowTraffic`
Fungsi yang digunakan untuk menjalankan tugas setelah grup target kedua melayani lalu lintas ke set tugas pengganti.
*Wajib*: Tidak
`ServiceRole`
Peran eksekusi untuk digunakan CloudFormation untuk melakukan penyebaran biru-hijau. Untuk daftar izin yang diperlukan, lihat[Izin IAM untuk penerapan blue/green](about-blue-green-deployments.md#blue-green-iam).
*Wajib*: Tidak
`Applications`
Menentukan properti aplikasi Amazon ECS.
*Wajib*: Ya
`Target`
*Wajib*: Ya
`Type`
Jenis sumber daya.
*Wajib*: Ya
`LogicalID`
ID logis sumber daya.
*Wajib*: Ya
`ECSAttributes`
Sumber daya yang mewakili berbagai persyaratan deployment aplikasi Amazon ECS Anda.
*Wajib*: Ya
`TaskDefinitions`
ID logis [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskdefinition.html) sumber daya untuk menjalankan kontainer Docker yang berisi aplikasi Amazon ECS Anda.
*Wajib*: Ya
`TaskSets`
Logika IDs sumber [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskset.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-taskset.html)daya untuk digunakan sebagai set tugas untuk aplikasi.
*Wajib*: Ya
`TrafficRouting`
Menentukan sumber daya yang digunakan untuk perutean lalu lintas.
*Wajib*: Ya
`ProdTrafficRoute`
Listener yang akan digunakan oleh penyeimbangan beban Anda untuk mengarahkan lalu lintas ke grup target Anda.
*Wajib*: Ya
`Type`
Jenis sumber daya. `AWS::ElasticLoadBalancingV2::Listener`
*Wajib*: Ya
`LogicalID`
ID logis sumber daya.
*Wajib*: Ya
`TestTrafficRoute`
Listener yang akan digunakan oleh penyeimbangan beban Anda untuk mengarahkan lalu lintas ke grup target Anda.
*Wajib*: Ya
`Type`
Jenis sumber daya. `AWS::ElasticLoadBalancingV2::Listener`
*Wajib*: Ya
`LogicalID`
ID logis sumber daya.
*Wajib*: Tidak
`TargetGroups`
ID logis sumber daya yang digunakan sebagai grup target untuk merutekan lalu lintas ke target terdaftar.
*Wajib*: Ya
# Contoh template penerapan biru/hijau
Contoh template berikut menyiapkan penyebaran CodeDeploy biru/hijau di ECS, dengan kemajuan perutean lalu lintas 15 persen per langkah dan periode stabilisasi 5 menit antara setiap langkah.
Membuat tumpukan dengan template akan menyediakan konfigurasi awal penerapan. Jika Anda kemudian membuat perubahan pada properti di `BlueTaskSet` sumber daya yang mengharuskan sumber daya diganti, maka CloudFormation akan memulai penerapan hijau sebagai bagian dari pembaruan tumpukan.
## JSON
```
{
"AWSTemplateFormatVersion":"2010-09-09",
"Parameters":{
"Vpc":{ "Type":"AWS::EC2::VPC::Id" },
"Subnet1":{ "Type":"AWS::EC2::Subnet::Id" },
"Subnet2":{ "Type":"AWS::EC2::Subnet::Id" }
},
"Transform":[ "AWS::CodeDeployBlueGreen" ],
"Hooks":{
"CodeDeployBlueGreenHook":{
"Type":"AWS::CodeDeploy::BlueGreen",
"Properties":{
"TrafficRoutingConfig":{
"Type":"TimeBasedCanary",
"TimeBasedCanary":{
"StepPercentage":15,
"BakeTimeMins":5
}
},
"Applications":[
{
"Target":{
"Type":"AWS::ECS::Service",
"LogicalID":"ECSDemoService"
},
"ECSAttributes":{
"TaskDefinitions":[ "BlueTaskDefinition","GreenTaskDefinition" ],
"TaskSets":[ "BlueTaskSet","GreenTaskSet" ],
"TrafficRouting":{
"ProdTrafficRoute":{
"Type":"AWS::ElasticLoadBalancingV2::Listener",
"LogicalID":"ALBListenerProdTraffic"
},
"TargetGroups":[ "ALBTargetGroupBlue","ALBTargetGroupGreen" ]
}
}
}
]
}
}
},
"Resources":{
"ExampleSecurityGroup":{
"Type":"AWS::EC2::SecurityGroup",
"Properties":{
"GroupDescription":"Security group for ec2 access",
"VpcId":{ "Ref":"Vpc" },
"SecurityGroupIngress":[
{
"IpProtocol":"tcp",
"FromPort":80,
"ToPort":80,
"CidrIp":"0.0.0.0/0"
},
{
"IpProtocol":"tcp",
"FromPort":8080,
"ToPort":8080,
"CidrIp":"0.0.0.0/0"
},
{
"IpProtocol":"tcp",
"FromPort":22,
"ToPort":22,
"CidrIp":"0.0.0.0/0"
}
]
}
},
"ALBTargetGroupBlue":{
"Type":"AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties":{
"HealthCheckIntervalSeconds":5,
"HealthCheckPath":"/",
"HealthCheckPort":"80",
"HealthCheckProtocol":"HTTP",
"HealthCheckTimeoutSeconds":2,
"HealthyThresholdCount":2,
"Matcher":{ "HttpCode":"200" },
"Port":80,
"Protocol":"HTTP",
"Tags":[{ "Key":"Group","Value":"Example" }],
"TargetType":"ip",
"UnhealthyThresholdCount":4,
"VpcId":{ "Ref":"Vpc" }
}
},
"ALBTargetGroupGreen":{
"Type":"AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties":{
"HealthCheckIntervalSeconds":5,
"HealthCheckPath":"/",
"HealthCheckPort":"80",
"HealthCheckProtocol":"HTTP",
"HealthCheckTimeoutSeconds":2,
"HealthyThresholdCount":2,
"Matcher":{ "HttpCode":"200" },
"Port":80,
"Protocol":"HTTP",
"Tags":[{ "Key":"Group","Value":"Example" }],
"TargetType":"ip",
"UnhealthyThresholdCount":4,
"VpcId":{ "Ref":"Vpc" }
}
},
"ExampleALB":{
"Type":"AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties":{
"Scheme":"internet-facing",
"SecurityGroups":[{ "Ref":"ExampleSecurityGroup" }],
"Subnets":[{ "Ref":"Subnet1" },{ "Ref":"Subnet2" }],
"Tags":[{ "Key":"Group","Value":"Example" }],
"Type":"application",
"IpAddressType":"ipv4"
}
},
"ALBListenerProdTraffic":{
"Type":"AWS::ElasticLoadBalancingV2::Listener",
"Properties":{
"DefaultActions":[
{
"Type":"forward",
"ForwardConfig":{
"TargetGroups":[
{
"TargetGroupArn":{ "Ref":"ALBTargetGroupBlue" },
"Weight":1
}
]
}
}
],
"LoadBalancerArn":{ "Ref":"ExampleALB" },
"Port":80,
"Protocol":"HTTP"
}
},
"ALBListenerProdRule":{
"Type":"AWS::ElasticLoadBalancingV2::ListenerRule",
"Properties":{
"Actions":[
{
"Type":"forward",
"ForwardConfig":{
"TargetGroups":[
{
"TargetGroupArn":{ "Ref":"ALBTargetGroupBlue" },
"Weight":1
}
]
}
}
],
"Conditions":[
{
"Field":"http-header",
"HttpHeaderConfig":{
"HttpHeaderName":"User-Agent",
"Values":[ "Mozilla" ]
}
}
],
"ListenerArn":{ "Ref":"ALBListenerProdTraffic" },
"Priority":1
}
},
"ECSTaskExecutionRole":{
"Type":"AWS::IAM::Role",
"Properties":{
"AssumeRolePolicyDocument":{
"Version": "2012-10-17",
"Statement":[
{
"Sid":"",
"Effect":"Allow",
"Principal":{
"Service":"ecs-tasks.amazonaws.com"
},
"Action":"sts:AssumeRole"
}
]
},
"ManagedPolicyArns":[ "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" ]
}
},
"BlueTaskDefinition":{
"Type":"AWS::ECS::TaskDefinition",
"Properties":{
"ExecutionRoleArn":{
"Fn::GetAtt":[ "ECSTaskExecutionRole","Arn" ]
},
"ContainerDefinitions":[
{
"Name":"DemoApp",
"Image":"nginxdemos/hello:latest",
"Essential":true,
"PortMappings":[
{
"HostPort":80,
"Protocol":"tcp",
"ContainerPort":80
}
]
}
],
"RequiresCompatibilities":[ "FARGATE" ],
"NetworkMode":"awsvpc",
"Cpu":"256",
"Memory":"512",
"Family":"ecs-demo"
}
},
"ECSDemoCluster":{
"Type":"AWS::ECS::Cluster",
"Properties":{}
},
"ECSDemoService":{
"Type":"AWS::ECS::Service",
"Properties":{
"Cluster":{ "Ref":"ECSDemoCluster" },
"DesiredCount":1,
"DeploymentController":{ "Type":"EXTERNAL" }
}
},
"BlueTaskSet":{
"Type":"AWS::ECS::TaskSet",
"Properties":{
"Cluster":{ "Ref":"ECSDemoCluster" },
"LaunchType":"FARGATE",
"NetworkConfiguration":{
"AwsVpcConfiguration":{
"AssignPublicIp":"ENABLED",
"SecurityGroups":[{ "Ref":"ExampleSecurityGroup" }],
"Subnets":[{ "Ref":"Subnet1" },{ "Ref":"Subnet2" }]
}
},
"PlatformVersion":"1.4.0",
"Scale":{
"Unit":"PERCENT",
"Value":100
},
"Service":{ "Ref":"ECSDemoService"},
"TaskDefinition":{ "Ref":"BlueTaskDefinition" },
"LoadBalancers":[
{
"ContainerName":"DemoApp",
"ContainerPort":80,
"TargetGroupArn":{ "Ref":"ALBTargetGroupBlue" }
}
]
}
},
"PrimaryTaskSet":{
"Type":"AWS::ECS::PrimaryTaskSet",
"Properties":{
"Cluster":{ "Ref":"ECSDemoCluster" },
"Service":{ "Ref":"ECSDemoService" },
"TaskSetId":{ "Fn::GetAtt":[ "BlueTaskSet","Id" ]
}
}
}
}
}
```
## YAML
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
Vpc:
Type: AWS::EC2::VPC::Id
Subnet1:
Type: AWS::EC2::Subnet::Id
Subnet2:
Type: AWS::EC2::Subnet::Id
Transform:
- 'AWS::CodeDeployBlueGreen'
Hooks:
CodeDeployBlueGreenHook:
Type: AWS::CodeDeploy::BlueGreen
Properties:
TrafficRoutingConfig:
Type: TimeBasedCanary
TimeBasedCanary:
StepPercentage: 15
BakeTimeMins: 5
Applications:
- Target:
Type: AWS::ECS::Service
LogicalID: ECSDemoService
ECSAttributes:
TaskDefinitions:
- BlueTaskDefinition
- GreenTaskDefinition
TaskSets:
- BlueTaskSet
- GreenTaskSet
TrafficRouting:
ProdTrafficRoute:
Type: AWS::ElasticLoadBalancingV2::Listener
LogicalID: ALBListenerProdTraffic
TargetGroups:
- ALBTargetGroupBlue
- ALBTargetGroupGreen
Resources:
ExampleSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for ec2 access
VpcId: !Ref Vpc
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 0.0.0.0/0
ALBTargetGroupBlue:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckIntervalSeconds: 5
HealthCheckPath: /
HealthCheckPort: '80'
HealthCheckProtocol: HTTP
HealthCheckTimeoutSeconds: 2
HealthyThresholdCount: 2
Matcher:
HttpCode: '200'
Port: 80
Protocol: HTTP
Tags:
- Key: Group
Value: Example
TargetType: ip
UnhealthyThresholdCount: 4
VpcId: !Ref Vpc
ALBTargetGroupGreen:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckIntervalSeconds: 5
HealthCheckPath: /
HealthCheckPort: '80'
HealthCheckProtocol: HTTP
HealthCheckTimeoutSeconds: 2
HealthyThresholdCount: 2
Matcher:
HttpCode: '200'
Port: 80
Protocol: HTTP
Tags:
- Key: Group
Value: Example
TargetType: ip
UnhealthyThresholdCount: 4
VpcId: !Ref Vpc
ExampleALB:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internet-facing
SecurityGroups:
- !Ref ExampleSecurityGroup
Subnets:
- !Ref Subnet1
- !Ref Subnet2
Tags:
- Key: Group
Value: Example
Type: application
IpAddressType: ipv4
ALBListenerProdTraffic:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- Type: forward
ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref ALBTargetGroupBlue
Weight: 1
LoadBalancerArn: !Ref ExampleALB
Port: 80
Protocol: HTTP
ALBListenerProdRule:
Type: AWS::ElasticLoadBalancingV2::ListenerRule
Properties:
Actions:
- Type: forward
ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref ALBTargetGroupBlue
Weight: 1
Conditions:
- Field: http-header
HttpHeaderConfig:
HttpHeaderName: User-Agent
Values:
- Mozilla
ListenerArn: !Ref ALBListenerProdTraffic
Priority: 1
ECSTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Sid: ''
Effect: Allow
Principal:
Service: ecs-tasks.amazonaws.com
Action: 'sts:AssumeRole'
ManagedPolicyArns:
- 'arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy'
BlueTaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
ExecutionRoleArn: !GetAtt
- ECSTaskExecutionRole
- Arn
ContainerDefinitions:
- Name: DemoApp
Image: 'nginxdemos/hello:latest'
Essential: true
PortMappings:
- HostPort: 80
Protocol: tcp
ContainerPort: 80
RequiresCompatibilities:
- FARGATE
NetworkMode: awsvpc
Cpu: '256'
Memory: '512'
Family: ecs-demo
ECSDemoCluster:
Type: AWS::ECS::Cluster
Properties: {}
ECSDemoService:
Type: AWS::ECS::Service
Properties:
Cluster: !Ref ECSDemoCluster
DesiredCount: 1
DeploymentController:
Type: EXTERNAL
BlueTaskSet:
Type: AWS::ECS::TaskSet
Properties:
Cluster: !Ref ECSDemoCluster
LaunchType: FARGATE
NetworkConfiguration:
AwsVpcConfiguration:
AssignPublicIp: ENABLED
SecurityGroups:
- !Ref ExampleSecurityGroup
Subnets:
- !Ref Subnet1
- !Ref Subnet2
PlatformVersion: 1.4.0
Scale:
Unit: PERCENT
Value: 100
Service: !Ref ECSDemoService
TaskDefinition: !Ref BlueTaskDefinition
LoadBalancers:
- ContainerName: DemoApp
ContainerPort: 80
TargetGroupArn: !Ref ALBTargetGroupBlue
PrimaryTaskSet:
Type: AWS::ECS::PrimaryTaskSet
Properties:
Cluster: !Ref ECSDemoCluster
Service: !Ref ECSDemoService
TaskSetId: !GetAtt
- BlueTaskSet
- Id
```
# CloudFormation cuplikan template
Bagian ini menyediakan sejumlah contoh skenario yang dapat Anda gunakan untuk memahami cara menyatakan berbagai bagian templat CloudFormation . Anda juga dapat menggunakan cuplikan sebagai titik awal untuk bagian templat kustom Anda.
**Topics**
+ [Snippet templat umum](quickref-general.md)
+ [Cuplikan CloudFormation templat penskalaan otomatis](quickref-autoscaling.md)
+ [AWS Cuplikan templat Konsol Penagihan](quickref-billingconductor.md)
+ [CloudFormation cuplikan template](quickref-cloudformation.md)
+ [Cuplikan CloudFront template Amazon](quickref-cloudfront.md)
+ [Cuplikan CloudWatch template Amazon](quickref-cloudwatch.md)
+ [Cuplikan templat Amazon CloudWatch Log](quickref-cloudwatchlogs.md)
+ [Cuplikan template Amazon DynamoDB](quickref-dynamodb.md)
+ [Cuplikan EC2 CloudFormation template Amazon](quickref-ec2.md)
+ [Templat contoh Layanan Kontainer Elastis Amazon](quickref-ecs.md)
+ [Templat Contoh Sistem File Elastis Amazon](quickref-efs.md)
+ [Cuplikan templat Elastic Beanstalk](quickref-elasticbeanstalk.md)
+ [Cuplikan templat Elastic Load Balancing](quickref-elb.md)
+ [AWS Identity and Access Management cuplikan template](quickref-iam.md)
+ [AWS Lambda Template](quickref-lambda.md)
+ [Cuplikan template Amazon Redshift](quickref-redshift.md)
+ [Cuplikan template Amazon RDS](quickref-rds.md)
+ [Cuplikan templat Route 53](quickref-route53.md)
+ [Cuplikan template Amazon S3](quickref-s3.md)
+ [Cuplikan template Amazon SNS](quickref-sns.md)
+ [Cuplikan template Amazon SQS](scenario-sqs-queue.md)
+ [Cuplikan template Amazon Timestream](scenario-timestream-queue.md)
# Snippet templat umum
Contoh berikut menunjukkan fitur CloudFormation template berbeda yang tidak spesifik untuk AWS layanan.
**Topics**
+ [Base64properti dikodekan UserData](#scenario-userdata-base64)
+ [Base64UserDataproperti yang dikodekan dengan dan AccessKey SecretKey](#scenario-userdata-base64-with-keys)
+ [Parametersbagian dengan satu parameter string literal](#scenario-one-string-parameter)
+ [Parametersbagian dengan parameter string dengan kendala ekspresi reguler](#scenario-constraint-string-parameter)
+ [Parametersbagian dengan parameter angka dengan MinValue dan MaxValue kendala](#scenario-one-number-min-parameter)
+ [Parametersbagian dengan parameter angka dengan AllowedValues kendala](#scenario-one-number-parameter)
+ [Parametersbagian dengan satu CommaDelimitedList parameter literal](#scenario-one-list-parameter)
+ [Parametersbagian dengan nilai parameter berdasarkan parameter semu](#scenario-one-pseudo-parameter)
+ [Mappingbagian dengan tiga pemetaan](#scenario-mapping-with-four-maps)
+ [Descriptionberdasarkan string literal](#scenario-description-from-literal-string)
+ [Outputsbagian dengan satu output string literal](#scenario-output-with-literal-string)
+ [Outputsbagian dengan satu referensi sumber daya dan satu output referensi semu](#scenario-output-with-ref-and-pseudo-ref)
+ [Outputsbagian dengan output berdasarkan fungsi, string literal, referensi, dan parameter semu](#scenario-output-with-complex-spec)
+ [Versi format templat](#scenario-format-version)
+ [AWS Tagsproperti](#scenario-format-aws-tag)
## Base64properti dikodekan UserData
Contoh ini menunjukkan perakitan `UserData` properti menggunakan `Fn::Base64` dan `Fn::Join` fungsi. Referensi `MyValue` dan `MyName` merupakan parameter yang harus ditentukan di `Parameters` bagian template. String literal `Hello World` hanyalah nilai lain yang diberikan contoh ini sebagai bagian dari `UserData`.
### JSON
```
1. "UserData" : {
2. "Fn::Base64" : {
3. "Fn::Join" : [ ",", [
4. { "Ref" : "MyValue" },
5. { "Ref" : "MyName" },
6. "Hello World" ] ]
7. }
8. }
```
### YAML
```
1. UserData:
2. Fn::Base64: !Sub |
3. Ref: MyValue
4. Ref: MyName
5. Hello World
```
## Base64UserDataproperti yang dikodekan dengan dan AccessKey SecretKey
Contoh ini menunjukkan perakitan `UserData` properti menggunakan `Fn::Base64` dan `Fn::Join` fungsi. Ini menyertakan informasi `AccessKey` dan `SecretKey`. Referensi `AccessKey` dan `SecretKey` adalah parameter yang harus ditentukan di bagian Parameter dari templat.
### JSON
```
1. "UserData" : {
2. "Fn::Base64" : {
3. "Fn::Join" : [ "", [
4. "ACCESS_KEY=", { "Ref" : "AccessKey" },
5. "SECRET_KEY=", { "Ref" : "SecretKey" } ]
6. ]
7. }
8. }
```
### YAML
```
1. UserData:
2. Fn::Base64: !Sub |
3. ACCESS_KEY=${AccessKey}
4. SECRET_KEY=${SecretKey}
```
## Parametersbagian dengan satu parameter string literal
Contoh berikut menggambarkan pernyataan bagian Parameter yang valid di mana parameter tipe `String` tunggal dinyatakan.
### JSON
```
1. "Parameters" : {
2. "UserName" : {
3. "Type" : "String",
4. "Default" : "nonadmin",
5. "Description" : "Assume a vanilla user if no command-line spec provided"
6. }
7. }
```
### YAML
```
1. Parameters:
2. UserName:
3. Type: String
4. Default: nonadmin
5. Description: Assume a vanilla user if no command-line spec provided
```
## Parametersbagian dengan parameter string dengan kendala ekspresi reguler
Contoh berikut menggambarkan pernyataan bagian Parameter yang valid di mana parameter tipe `String` tunggal dinyatakan. `AdminUserAccount`Parameter memiliki default`admin`. Nilai parameter harus memiliki panjang minimum 1, panjang maksimum 16, dan berisi karakter abjad dan angka tetapi harus dimulai dengan karakter abjad.
### JSON
```
1. "Parameters" : {
2. "AdminUserAccount": {
3. "Default": "admin",
4. "NoEcho": "true",
5. "Description" : "The admin account user name",
6. "Type": "String",
7. "MinLength": "1",
8. "MaxLength": "16",
9. "AllowedPattern" : "[a-zA-Z][a-zA-Z0-9]*"
10. }
11. }
```
### YAML
```
1. Parameters:
2. AdminUserAccount:
3. Default: admin
4. NoEcho: true
5. Description: The admin account user name
6. Type: String
7. MinLength: 1
8. MaxLength: 16
9. AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
```
## Parametersbagian dengan parameter angka dengan MinValue dan MaxValue kendala
Contoh berikut menggambarkan pernyataan bagian Parameter yang valid di mana parameter tipe `Number` tunggal dinyatakan. `WebServerPort`Parameter memiliki default 80 dan nilai minimum 1 dan nilai maksimum 65535.
### JSON
```
1. "Parameters" : {
2. "WebServerPort": {
3. "Default": "80",
4. "Description" : "TCP/IP port for the web server",
5. "Type": "Number",
6. "MinValue": "1",
7. "MaxValue": "65535"
8. }
9. }
```
### YAML
```
1. Parameters:
2. WebServerPort:
3. Default: 80
4. Description: TCP/IP port for the web server
5. Type: Number
6. MinValue: 1
7. MaxValue: 65535
```
## Parametersbagian dengan parameter angka dengan AllowedValues kendala
Contoh berikut menggambarkan pernyataan bagian Parameter yang valid di mana parameter tipe `Number` tunggal dinyatakan. `WebServerPort`Parameter memiliki default 80 dan hanya memungkinkan nilai 80 dan 8888.
### JSON
```
1. "Parameters" : {
2. "WebServerPortLimited": {
3. "Default": "80",
4. "Description" : "TCP/IP port for the web server",
5. "Type": "Number",
6. "AllowedValues" : ["80", "8888"]
7. }
8. }
```
### YAML
```
1. Parameters:
2. WebServerPortLimited:
3. Default: 80
4. Description: TCP/IP port for the web server
5. Type: Number
6. AllowedValues:
7. - 80
8. - 8888
```
## Parametersbagian dengan satu CommaDelimitedList parameter literal
Contoh berikut menggambarkan deklarasi `Parameters` bagian yang valid di mana parameter `CommaDelimitedList` tipe tunggal dideklarasikan. `NoEcho`Properti diatur ke`TRUE`, yang akan menutupi nilainya dengan tanda bintang (\$1\$1\$1\$1\$1) dalam **describe-stacks** output, kecuali untuk informasi yang disimpan di lokasi yang ditentukan di bawah ini.
**penting**
Menggunakan `NoEcho` atribut tidak menutupi informasi apa pun yang disimpan sebagai berikut:
Bagian `Metadata` template. CloudFormation tidak mengubah, memodifikasi, atau menyunting informasi apa pun yang Anda sertakan di `Metadata` bagian ini. Untuk informasi selengkapnya, lihat [Metadata](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html).
Bagian `Outputs` template. Untuk informasi lebih lanjut, lihat [Output](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html).
`Metadata`Atribut definisi sumber daya. Untuk informasi lebih lanjut, lihat [Atribut `Metadata`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-metadata.html).
Kami sangat menyarankan Anda untuk tidak menggunakan mekanisme ini untuk memasukkan informasi sensitif, seperti kata sandi atau rahasia.
**penting**
Daripada menyematkan informasi sensitif secara langsung di CloudFormation template Anda, kami sarankan Anda menggunakan parameter dinamis dalam template tumpukan untuk mereferensikan informasi sensitif yang disimpan dan dikelola di luar CloudFormation, seperti di AWS Systems Manager Parameter Store atau AWS Secrets Manager.
Untuk informasi selengkapnya, lihat Do [not embed credentials dalam praktik terbaik template Anda](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-best-practices.html#creds).
### JSON
```
1. "Parameters" : {
2. "UserRoles" : {
3. "Type" : "CommaDelimitedList",
4. "Default" : "guest,newhire",
5. "NoEcho" : "TRUE"
6. }
7. }
```
### YAML
```
1. Parameters:
2. UserRoles:
3. Type: CommaDelimitedList
4. Default: "guest,newhire"
5. NoEcho: true
```
## Parametersbagian dengan nilai parameter berdasarkan parameter semu
Contoh berikut menunjukkan perintah dalam data pengguna EC2 yang menggunakan `AWS::StackName` dan `AWS::Region` parameter semu. Untuk informasi selengkapnya tentang parameter semu, lihat[Dapatkan AWS nilai menggunakan parameter semu](pseudo-parameter-reference.md).
### JSON
```
1. "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
2. "#!/bin/bash -xe\n",
3. "yum install -y aws-cfn-bootstrap\n",
4.
5. "/opt/aws/bin/cfn-init -v ",
6. " --stack ", { "Ref" : "AWS::StackName" },
7. " --resource LaunchConfig ",
8. " --region ", { "Ref" : "AWS::Region" }, "\n",
9.
10. "/opt/aws/bin/cfn-signal -e $? ",
11. " --stack ", { "Ref" : "AWS::StackName" },
12. " --resource WebServerGroup ",
13. " --region ", { "Ref" : "AWS::Region" }, "\n"
14. ]]}}
15. }
```
### YAML
```
1. UserData:
2. Fn::Base64: !Sub |
3. #!/bin/bash -xe
4. yum update -y aws-cfn-bootstrap
5. /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfig --region ${AWS::Region}
6. /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerGroup --region ${AWS::Region}
```
## Mappingbagian dengan tiga pemetaan
Contoh berikut menggambarkan deklarasi `Mapping` bagian yang valid yang berisi tiga pemetaan. Peta tersebut, ketika dicocokkan dengan kunci pemetaan `Stop`, `SlowDown`, atau `Go`, menyediakan nilai-nilai RGB yang ditetapkan untuk atribut `RGBColor` terkait.
### JSON
```
1. "Mappings" : {
2. "LightColor" : {
3. "Stop" : {
4. "Description" : "red",
5. "RGBColor" : "RED 255 GREEN 0 BLUE 0"
6. },
7. "SlowDown" : {
8. "Description" : "yellow",
9. "RGBColor" : "RED 255 GREEN 255 BLUE 0"
10. },
11. "Go" : {
12. "Description" : "green",
13. "RGBColor" : "RED 0 GREEN 128 BLUE 0"
14. }
15. }
16. }
```
### YAML
```
1. Mappings:
2. LightColor:
3. Stop:
4. Description: red
5. RGBColor: "RED 255 GREEN 0 BLUE 0"
6. SlowDown:
7. Description: yellow
8. RGBColor: "RED 255 GREEN 255 BLUE 0"
9. Go:
10. Description: green
11. RGBColor: "RED 0 GREEN 128 BLUE 0"
```
## Descriptionberdasarkan string literal
Contoh berikut menggambarkan deklarasi `Description` bagian yang valid di mana nilai didasarkan pada string literal. Snippet ini bisa untuk templat, parameter, sumber daya, properti, atau output.
### JSON
```
1. "Description" : "Replace this value"
```
### YAML
```
1. Description: "Replace this value"
```
## Outputsbagian dengan satu output string literal
Contoh ini menunjukkan tugas output berdasarkan string literal.
### JSON
```
1. "Outputs" : {
2. "MyPhone" : {
3. "Value" : "Please call 555-5555",
4. "Description" : "A random message for aws cloudformation describe-stacks"
5. }
6. }
```
### YAML
```
1. Outputs:
2. MyPhone:
3. Value: Please call 555-5555
4. Description: A random message for aws cloudformation describe-stacks
```
## Outputsbagian dengan satu referensi sumber daya dan satu output referensi semu
Contoh ini menunjukkan `Outputs` bagian dengan dua tugas keluaran. Salah satunya didasarkan pada sumber daya, dan yang lainnya didasarkan pada referensi semu.
### JSON
```
1. "Outputs" : {
2. "SNSTopic" : { "Value" : { "Ref" : "MyNotificationTopic" } },
3. "StackName" : { "Value" : { "Ref" : "AWS::StackName" } }
4. }
```
### YAML
```
1. Outputs:
2. SNSTopic:
3. Value: !Ref MyNotificationTopic
4. StackName:
5. Value: !Ref AWS::StackName
```
## Outputsbagian dengan output berdasarkan fungsi, string literal, referensi, dan parameter semu
Contoh ini menunjukkan bagian Output dengan satu tugas output. Fungsi Join digunakan untuk menggabungkan nilai, menggunakan tanda persen sebagai pembatas.
### JSON
```
1. "Outputs" : {
2. "MyOutput" : {
3. "Value" : { "Fn::Join" :
4. [ "%", [ "A-string", {"Ref" : "AWS::StackName" } ] ]
5. }
6. }
7. }
```
### YAML
```
1. Outputs:
2. MyOutput:
3. Value: !Join [ %, [ 'A-string', !Ref 'AWS::StackName' ]]
```
## Versi format templat
Cuplikan berikut menggambarkan deklarasi bagian yang valid`AWSTemplateFormatVersion`.
### JSON
```
1. "AWSTemplateFormatVersion" : "2010-09-09"
```
### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
```
## AWS Tagsproperti
Contoh ini menunjukkan AWS `Tags` properti. Anda akan menentukan properti ini di dalam bagian Properti dari sumber daya. Ketika sumber daya dibuat, sumber daya tersebut akan ditandai dengan tanda yang Anda nyatakan.
### JSON
```
1. "Tags" : [
2. {
3. "Key" : "keyname1",
4. "Value" : "value1"
5. },
6. {
7. "Key" : "keyname2",
8. "Value" : "value2"
9. }
10. ]
```
### YAML
```
1. Tags:
2. -
3. Key: "keyname1"
4. Value: "value1"
5. -
6. Key: "keyname2"
7. Value: "value2"
```
# Cuplikan CloudFormation templat penskalaan otomatis
Dengan Amazon EC2 Auto Scaling, Anda dapat secara otomatis menskalakan EC2 instans Amazon, baik dengan kebijakan penskalaan atau dengan penskalaan terjadwal. Grup Auto Scaling adalah kumpulan EC2 instans Amazon yang memungkinkan penskalaan otomatis dan fitur pengelolaan armada, seperti kebijakan penskalaan, tindakan terjadwal, pemeriksaan kesehatan, kait siklus hidup, dan penyeimbangan beban.
Application Auto Scaling menyediakan penskalaan otomatis berbagai sumber daya di luar Amazon EC2, baik dengan kebijakan penskalaan atau dengan penskalaan terjadwal.
Anda dapat membuat dan mengonfigurasi grup Auto Scaling, kebijakan penskalaan, tindakan terjadwal, dan sumber daya penskalaan otomatis lainnya sebagai bagian dari infrastruktur menggunakan templat. CloudFormation Template memudahkan pengelolaan dan otomatisasi penyebaran sumber daya penskalaan otomatis secara berulang dan konsisten.
Contoh cuplikan template berikut menjelaskan CloudFormation sumber daya atau komponen untuk Amazon Auto EC2 Scaling dan Application Auto Scaling. Cuplikan ini dirancang untuk diintegrasikan ke dalam template dan tidak dimaksudkan untuk dijalankan secara independen.
**Topics**
+ [Konfigurasikan sumber daya Amazon EC2 Auto Scaling](quickref-ec2-auto-scaling.md)
+ [Konfigurasikan sumber daya Application Auto Scaling](quickref-application-auto-scaling.md)
# Konfigurasikan sumber daya Amazon EC2 Auto Scaling dengan CloudFormation
Contoh berikut menunjukkan cuplikan berbeda untuk disertakan dalam templat untuk digunakan dengan Amazon EC2 Auto Scaling.
**Topics**
+ [Buat satu contoh grup Auto Scaling](#scenario-single-instance-as-group)
+ [Buat grup Auto Scaling dengan penyeimbang beban terlampir](#scenario-as-group)
+ [Buat grup Auto Scaling dengan notifikasi](#scenario-as-notification)
+ [Buat grup Auto Scaling yang menggunakan a dan `CreationPolicy` `UpdatePolicy`](#scenario-as-updatepolicy)
+ [Membuat kebijakan penskalaan langkah](#scenario-step-scaling-policy)
+ [Contoh kelompok contoh campuran](#scenario-mixed-instances-group-template-examples)
+ [Luncurkan contoh konfigurasi](#scenario-launch-config-template-examples)
## Buat satu contoh grup Auto Scaling
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya dengan satu instance untuk membantu Anda memulai. `VPCZoneIdentifier`Properti grup Auto Scaling menentukan daftar subnet yang ada di tiga Availability Zone yang berbeda. Anda harus menentukan subnet yang berlaku IDs dari akun Anda sebelum Anda membuat tumpukan Anda. `LaunchTemplate`Properti mereferensikan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya dengan nama logis `myLaunchTemplate` yang didefinisikan di tempat lain dalam template Anda.
**catatan**
Untuk contoh templat peluncuran, lihat [Buat template peluncuran dengan CloudFormation](quickref-ec2-launch-templates.md) di bagian cuplikan Amazon EC2 dan bagian [Contoh di sumber daya](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html#aws-resource-ec2-launchtemplate--examples). `AWS::EC2::LaunchTemplate`
### JSON
```
1. "myASG" : {
2. "Type" : "AWS::AutoScaling::AutoScalingGroup",
3. "Properties" : {
4. "VPCZoneIdentifier" : [ "subnetIdAz1", "subnetIdAz2", "subnetIdAz3" ],
5. "LaunchTemplate" : {
6. "LaunchTemplateId" : {
7. "Ref" : "myLaunchTemplate"
8. },
9. "Version" : {
10. "Fn::GetAtt" : [
11. "myLaunchTemplate",
12. "LatestVersionNumber"
13. ]
14. }
15. },
16. "MaxSize" : "1",
17. "MinSize" : "1"
18. }
19. }
```
### YAML
```
1. myASG:
2. Type: AWS::AutoScaling::AutoScalingGroup
3. Properties:
4. VPCZoneIdentifier:
5. - subnetIdAz1
6. - subnetIdAz2
7. - subnetIdAz3
8. LaunchTemplate:
9. LaunchTemplateId: !Ref myLaunchTemplate
10. Version: !GetAtt myLaunchTemplate.LatestVersionNumber
11. MaxSize: '1'
12. MinSize: '1'
```
## Buat grup Auto Scaling dengan penyeimbang beban terlampir
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya untuk load balancing melalui beberapa server. Ini menentukan nama logis AWS sumber daya yang dinyatakan di tempat lain dalam template yang sama.
1. `VPCZoneIdentifier`Properti menentukan nama logis dari dua [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-subnet.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-subnet.html)sumber daya tempat instans EC2 grup Auto Scaling akan dibuat: dan. `myPublicSubnet1` `myPublicSubnet2`
1. `LaunchTemplate`Properti menentukan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya dengan nama `myLaunchTemplate` logis.
1. `TargetGroupARNs`Properti mencantumkan grup target untuk Application Load Balancer atau Network Load Balancer yang digunakan untuk merutekan lalu lintas ke grup Auto Scaling. Dalam contoh ini, satu kelompok target ditentukan, [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html)sumber daya dengan nama logis`myTargetGroup`.
### JSON
```
1. "myServerGroup" : {
2. "Type" : "AWS::AutoScaling::AutoScalingGroup",
3. "Properties" : {
4. "VPCZoneIdentifier" : [ { "Ref" : "myPublicSubnet1" }, { "Ref" : "myPublicSubnet2" } ],
5. "LaunchTemplate" : {
6. "LaunchTemplateId" : {
7. "Ref" : "myLaunchTemplate"
8. },
9. "Version" : {
10. "Fn::GetAtt" : [
11. "myLaunchTemplate",
12. "LatestVersionNumber"
13. ]
14. }
15. },
16. "MaxSize" : "5",
17. "MinSize" : "1",
18. "TargetGroupARNs" : [ { "Ref" : "myTargetGroup" } ]
19. }
20. }
```
### YAML
```
1. myServerGroup:
2. Type: AWS::AutoScaling::AutoScalingGroup
3. Properties:
4. VPCZoneIdentifier:
5. - !Ref myPublicSubnet1
6. - !Ref myPublicSubnet2
7. LaunchTemplate:
8. LaunchTemplateId: !Ref myLaunchTemplate
9. Version: !GetAtt myLaunchTemplate.LatestVersionNumber
10. MaxSize: '5'
11. MinSize: '1'
12. TargetGroupARNs:
13. - !Ref myTargetGroup
```
### Lihat juga
[Untuk contoh mendetail yang membuat grup Auto Scaling dengan kebijakan penskalaan pelacakan target berdasarkan metrik yang `ALBRequestCountPerTarget` telah ditentukan untuk Application Load Balancer, lihat bagian Contoh di sumber daya.](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-scalingpolicy.html#aws-resource-autoscaling-scalingpolicy--examples) `AWS::AutoScaling::ScalingPolicy`
## Buat grup Auto Scaling dengan notifikasi
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya yang mengirimkan notifikasi Amazon SNS saat peristiwa yang ditentukan berlangsung. `NotificationConfigurations`Properti menentukan topik SNS di mana CloudFormation mengirimkan pemberitahuan dan peristiwa yang akan menyebabkan CloudFormation untuk mengirim pemberitahuan. Ketika peristiwa yang ditentukan oleh `NotificationTypes` terjadi, CloudFormation akan mengirim pemberitahuan ke topik SNS yang ditentukan oleh`TopicARN`. Saat Anda meluncurkan tumpukan, CloudFormation buat [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-subscription.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-subscription.html)resource (`snsTopicForAutoScalingGroup`) yang dideklarasikan dalam template yang sama.
`VPCZoneIdentifier`Properti grup Auto Scaling menentukan daftar subnet yang ada di tiga Availability Zone yang berbeda. Anda harus menentukan subnet yang berlaku IDs dari akun Anda sebelum Anda membuat tumpukan Anda. `LaunchTemplate`Properti mereferensikan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya yang dideklarasikan di tempat lain dalam template yang sama.
### JSON
```
1. "myASG" : {
2. "Type" : "AWS::AutoScaling::AutoScalingGroup",
3. "DependsOn": [
4. "snsTopicForAutoScalingGroup"
5. ],
6. "Properties" : {
7. "VPCZoneIdentifier" : [ "subnetIdAz1", "subnetIdAz2", "subnetIdAz3" ],
8. "LaunchTemplate" : {
9. "LaunchTemplateId" : {
10. "Ref" : "logicalName"
11. },
12. "Version" : {
13. "Fn::GetAtt" : [
14. "logicalName",
15. "LatestVersionNumber"
16. ]
17. }
18. },
19. "MaxSize" : "5",
20. "MinSize" : "1",
21. "NotificationConfigurations" : [
22. {
23. "TopicARN" : { "Ref" : "snsTopicForAutoScalingGroup" },
24. "NotificationTypes" : [
25. "autoscaling:EC2_INSTANCE_LAUNCH",
26. "autoscaling:EC2_INSTANCE_LAUNCH_ERROR",
27. "autoscaling:EC2_INSTANCE_TERMINATE",
28. "autoscaling:EC2_INSTANCE_TERMINATE_ERROR",
29. "autoscaling:TEST_NOTIFICATION"
30. ]
31. }
32. ]
33. }
34. }
```
### YAML
```
1. myASG:
2. Type: AWS::AutoScaling::AutoScalingGroup
3. DependsOn:
4. - snsTopicForAutoScalingGroup
5. Properties:
6. VPCZoneIdentifier:
7. - subnetIdAz1
8. - subnetIdAz2
9. - subnetIdAz3
10. LaunchTemplate:
11. LaunchTemplateId: !Ref logicalName
12. Version: !GetAtt logicalName.LatestVersionNumber
13. MaxSize: '5'
14. MinSize: '1'
15. NotificationConfigurations:
16. - TopicARN: !Ref snsTopicForAutoScalingGroup
17. NotificationTypes:
18. - autoscaling:EC2_INSTANCE_LAUNCH
19. - autoscaling:EC2_INSTANCE_LAUNCH_ERROR
20. - autoscaling:EC2_INSTANCE_TERMINATE
21. - autoscaling:EC2_INSTANCE_TERMINATE_ERROR
22. - autoscaling:TEST_NOTIFICATION
```
## Buat grup Auto Scaling yang menggunakan a dan `CreationPolicy` `UpdatePolicy`
Contoh berikut menunjukkan cara menambahkan `CreationPolicy` dan `UpdatePolicy` atribut ke [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya.
Kebijakan pembuatan sampel mencegah grup Auto Scaling mencapai `CREATE_COMPLETE` status hingga CloudFormation menerima `Count` sejumlah sinyal keberhasilan saat grup siap. Untuk memberi sinyal bahwa grup Auto Scaling sudah siap, skrip `cfn-signal` helper yang ditambahkan ke data pengguna template peluncuran (tidak ditampilkan) dijalankan pada instance. Jika instance tidak mengirim sinyal dalam yang ditentukan`Timeout`, CloudFormation mengasumsikan bahwa instance tidak dibuat, pembuatan sumber daya gagal, dan CloudFormation memutar tumpukan kembali.
Kebijakan pembaruan sampel menginstruksikan CloudFormation untuk melakukan pembaruan bergulir menggunakan `AutoScalingRollingUpdate` properti. Pembaruan bergulir membuat perubahan pada grup Auto Scaling dalam batch kecil (untuk contoh ini, instance demi instance) berdasarkan `MaxBatchSize` dan waktu jeda antara kumpulan pembaruan berdasarkan. `PauseTime` `MinInstancesInService`Atribut menentukan jumlah minimum instance yang harus dalam layanan dalam grup Auto Scaling CloudFormation sementara memperbarui instance lama.
Atribut `WaitOnResourceSignals` diatur menjadi `true`. CloudFormation harus menerima sinyal dari setiap instans baru dalam `PauseTime` yang ditentukan sebelum melanjutkan pembaruan. Sementara pembaruan tumpukan sedang berlangsung, proses EC2 Auto Scaling berikut ditangguhkan: `HealthCheck`, `ReplaceUnhealthy`, `AZRebalance`, `AlarmNotification`, dan `ScheduledActions`. Catatan: Jangan menangguhkan jenis proses`Launch`,`Terminate`, atau `AddToLoadBalancer` (jika grup Auto Scaling digunakan dengan Elastic Load Balancing) karena hal itu dapat mencegah pembaruan bergulir berfungsi dengan baik.
`VPCZoneIdentifier`Properti grup Auto Scaling menentukan daftar subnet yang ada di tiga Availability Zone yang berbeda. Anda harus menentukan subnet yang berlaku IDs dari akun Anda sebelum Anda membuat tumpukan Anda. `LaunchTemplate`Properti mereferensikan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya yang dideklarasikan di tempat lain dalam template yang sama.
Untuk informasi selengkapnya tentang `UpdatePolicy` atribut `CreationPolicy` dan, lihat [Referensi atribut sumber daya](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-product-attribute-reference.html).
### JSON
```
{
"Resources":{
"myASG":{
"CreationPolicy":{
"ResourceSignal":{
"Count":"3",
"Timeout":"PT15M"
}
},
"UpdatePolicy":{
"AutoScalingRollingUpdate":{
"MinInstancesInService":"3",
"MaxBatchSize":"1",
"PauseTime":"PT12M5S",
"WaitOnResourceSignals":"true",
"SuspendProcesses":[
"HealthCheck",
"ReplaceUnhealthy",
"AZRebalance",
"AlarmNotification",
"ScheduledActions",
"InstanceRefresh"
]
}
},
"Type":"AWS::AutoScaling::AutoScalingGroup",
"Properties":{
"VPCZoneIdentifier":[ "subnetIdAz1", "subnetIdAz2", "subnetIdAz3" ],
"LaunchTemplate":{
"LaunchTemplateId":{
"Ref":"logicalName"
},
"Version":{
"Fn::GetAtt":[
"logicalName",
"LatestVersionNumber"
]
}
},
"MaxSize":"5",
"MinSize":"3"
}
}
}
}
```
### YAML
```
---
Resources:
myASG:
CreationPolicy:
ResourceSignal:
Count: '3'
Timeout: PT15M
UpdatePolicy:
AutoScalingRollingUpdate:
MinInstancesInService: '3'
MaxBatchSize: '1'
PauseTime: PT12M5S
WaitOnResourceSignals: true
SuspendProcesses:
- HealthCheck
- ReplaceUnhealthy
- AZRebalance
- AlarmNotification
- ScheduledActions
- InstanceRefresh
Type: AWS::AutoScaling::AutoScalingGroup
Properties:
VPCZoneIdentifier:
- subnetIdAz1
- subnetIdAz2
- subnetIdAz3
LaunchTemplate:
LaunchTemplateId: !Ref logicalName
Version: !GetAtt logicalName.LatestVersionNumber
MaxSize: '5'
MinSize: '3'
```
## Membuat kebijakan penskalaan langkah
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-scalingpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-scalingpolicy.html)sumber daya yang menskalakan grup Auto Scaling menggunakan kebijakan penskalaan langkah. Properti `AdjustmentType` menentukan `ChangeInCapacity`, yang berarti bahwa `ScalingAdjustment` mewakili jumlah instans untuk ditambahkan (jika `ScalingAdjustment` positif) atau dihapus (jika negatif). Dalam contoh ini, `ScalingAdjustment` adalah 1; oleh karena itu, kebijakan tersebut menambah jumlah instans EC2 dalam grup sebanyak 1 ketika ambang batas alarm dilanggar.
[https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarm.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarm.html)Sumber daya `CPUAlarmHigh` menentukan kebijakan penskalaan `ASGScalingPolicyHigh` sebagai tindakan yang akan dijalankan saat alarm berada dalam status ALARM ()`AlarmActions`. `Dimensions`Properti mereferensikan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya yang dideklarasikan di tempat lain dalam template yang sama.
### JSON
```
1. {
2. "Resources":{
3. "ASGScalingPolicyHigh":{
4. "Type":"AWS::AutoScaling::ScalingPolicy",
5. "Properties":{
6. "AutoScalingGroupName":{ "Ref":"logicalName" },
7. "PolicyType":"StepScaling",
8. "AdjustmentType":"ChangeInCapacity",
9. "StepAdjustments":[
10. {
11. "MetricIntervalLowerBound":0,
12. "ScalingAdjustment":1
13. }
14. ]
15. }
16. },
17. "CPUAlarmHigh":{
18. "Type":"AWS::CloudWatch::Alarm",
19. "Properties":{
20. "EvaluationPeriods":"2",
21. "Statistic":"Average",
22. "Threshold":"90",
23. "AlarmDescription":"Scale out if CPU > 90% for 2 minutes",
24. "Period":"60",
25. "AlarmActions":[ { "Ref":"ASGScalingPolicyHigh" } ],
26. "Namespace":"AWS/EC2",
27. "Dimensions":[
28. {
29. "Name":"AutoScalingGroupName",
30. "Value":{ "Ref":"logicalName" }
31. }
32. ],
33. "ComparisonOperator":"GreaterThanThreshold",
34. "MetricName":"CPUUtilization"
35. }
36. }
37. }
38. }
```
### YAML
```
1. ---
2. Resources:
3. ASGScalingPolicyHigh:
4. Type: AWS::AutoScaling::ScalingPolicy
5. Properties:
6. AutoScalingGroupName: !Ref logicalName
7. PolicyType: StepScaling
8. AdjustmentType: ChangeInCapacity
9. StepAdjustments:
10. - MetricIntervalLowerBound: 0
11. ScalingAdjustment: 1
12. CPUAlarmHigh:
13. Type: AWS::CloudWatch::Alarm
14. Properties:
15. EvaluationPeriods: 2
16. Statistic: Average
17. Threshold: 90
18. AlarmDescription: 'Scale out if CPU > 90% for 2 minutes'
19. Period: 60
20. AlarmActions:
21. - !Ref ASGScalingPolicyHigh
22. Namespace: AWS/EC2
23. Dimensions:
24. - Name: AutoScalingGroupName
25. Value:
26. !Ref logicalName
27. ComparisonOperator: GreaterThanThreshold
28. MetricName: CPUUtilization
```
### Lihat juga
Untuk contoh templat lainnya untuk kebijakan penskalaan, lihat bagian [Contoh](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-scalingpolicy.html#aws-resource-autoscaling-scalingpolicy--examples) di `AWS::AutoScaling::ScalingPolicy` sumber daya.
## Contoh kelompok contoh campuran
### Membuat grup Auto Scaling menggunakan pemilihan tipe instans berbasis atribut
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya yang berisi informasi untuk meluncurkan grup instance campuran menggunakan pemilihan tipe instans berbasis atribut. Anda menentukan nilai minimum dan maksimum untuk `VCpuCount` properti dan nilai minimum untuk `MemoryMiB` properti. Tipe instans apa pun yang digunakan oleh grup Auto Scaling harus sesuai dengan atribut instance yang diperlukan.
`VPCZoneIdentifier`Properti grup Auto Scaling menentukan daftar subnet yang ada di tiga Availability Zone yang berbeda. Anda harus menentukan subnet yang berlaku IDs dari akun Anda sebelum Anda membuat tumpukan Anda. `LaunchTemplate`Properti mereferensikan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya yang dideklarasikan di tempat lain dalam template yang sama.
#### JSON
```
1. {
2. "Resources":{
3. "myASG":{
4. "Type":"AWS::AutoScaling::AutoScalingGroup",
5. "Properties":{
6. "VPCZoneIdentifier":[
7. "subnetIdAz1",
8. "subnetIdAz2",
9. "subnetIdAz3"
10. ],
11. "MixedInstancesPolicy":{
12. "LaunchTemplate":{
13. "LaunchTemplateSpecification":{
14. "LaunchTemplateId":{
15. "Ref":"logicalName"
16. },
17. "Version":{
18. "Fn::GetAtt":[
19. "logicalName",
20. "LatestVersionNumber"
21. ]
22. }
23. },
24. "Overrides":[
25. {
26. "InstanceRequirements":{
27. "VCpuCount":{
28. "Min":2,
29. "Max":4
30. },
31. "MemoryMiB":{
32. "Min":2048
33. }
34. }
35. }
36. ]
37. }
38. },
39. "MaxSize":"5",
40. "MinSize":"1"
41. }
42. }
43. }
44. }
```
#### YAML
```
1. ---
2. Resources:
3. myASG:
4. Type: AWS::AutoScaling::AutoScalingGroup
5. Properties:
6. VPCZoneIdentifier:
7. - subnetIdAz1
8. - subnetIdAz2
9. - subnetIdAz3
10. MixedInstancesPolicy:
11. LaunchTemplate:
12. LaunchTemplateSpecification:
13. LaunchTemplateId: !Ref logicalName
14. Version: !GetAtt logicalName.LatestVersionNumber
15. Overrides:
16. - InstanceRequirements:
17. VCpuCount:
18. Min: 2
19. Max: 4
20. MemoryMiB:
21. Min: 2048
22. MaxSize: '5'
23. MinSize: '1'
```
## Luncurkan contoh konfigurasi
### Buat konfigurasi peluncuran
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-launchconfiguration.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-launchconfiguration.html)sumber daya untuk grup Auto Scaling tempat Anda menentukan nilai untuk`ImageId`,`InstanceType`, dan `SecurityGroups` properti. `SecurityGroups`Properti menentukan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya yang ditentukan di tempat lain dalam template, dan grup keamanan EC2 yang ada bernama. `myExistingEC2SecurityGroup`
#### JSON
```
1. "mySimpleConfig" : {
2. "Type" : "AWS::AutoScaling::LaunchConfiguration",
3. "Properties" : {
4. "ImageId" : "ami-02354e95b3example",
5. "InstanceType" : "t3.micro",
6. "SecurityGroups" : [ { "Ref" : "logicalName" }, "myExistingEC2SecurityGroup" ]
7. }
8. }
```
#### YAML
```
1. mySimpleConfig:
2. Type: AWS::AutoScaling::LaunchConfiguration
3. Properties:
4. ImageId: ami-02354e95b3example
5. InstanceType: t3.micro
6. SecurityGroups:
7. - !Ref logicalName
8. - myExistingEC2SecurityGroup
```
### Membuat grup Auto Scaling yang menggunakan konfigurasi peluncuran
Contoh ini menunjukkan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html)sumber daya dengan satu contoh. `VPCZoneIdentifier`Properti grup Auto Scaling menentukan daftar subnet yang ada di tiga Availability Zone yang berbeda. Anda harus menentukan subnet yang berlaku IDs dari akun Anda sebelum Anda membuat tumpukan Anda. `LaunchConfigurationName`Properti mereferensikan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-launchconfiguration.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-launchconfiguration.html)sumber daya dengan nama logis `mySimpleConfig` yang didefinisikan dalam template Anda.
#### JSON
```
1. "myASG" : {
2. "Type" : "AWS::AutoScaling::AutoScalingGroup",
3. "Properties" : {
4. "VPCZoneIdentifier" : [ "subnetIdAz1", "subnetIdAz2", "subnetIdAz3" ],
5. "LaunchConfigurationName" : { "Ref" : "mySimpleConfig" },
6. "MaxSize" : "1",
7. "MinSize" : "1"
8. }
9. }
```
#### YAML
```
1. myASG:
2. Type: AWS::AutoScaling::AutoScalingGroup
3. Properties:
4. VPCZoneIdentifier:
5. - subnetIdAz1
6. - subnetIdAz2
7. - subnetIdAz3
8. LaunchConfigurationName: !Ref mySimpleConfig
9. MaxSize: '1'
10. MinSize: '1'
```
# Konfigurasikan sumber daya Application Auto Scaling dengan CloudFormation
Bagian ini memberikan contoh CloudFormation templat untuk kebijakan penskalaan Application Auto Scaling dan tindakan terjadwal untuk sumber daya yang berbeda. AWS
**penting**
Ketika cuplikan Application Auto Scaling disertakan dalam template, Anda mungkin perlu mendeklarasikan dependensi pada sumber daya tertentu yang dapat diskalakan yang dibuat melalui template menggunakan atribut. `DependsOn` Ini menimpa paralelisme default dan mengarahkan CloudFormation untuk beroperasi pada sumber daya dalam urutan tertentu. Jika tidak, konfigurasi penskalaan mungkin diterapkan sebelum sumber daya telah disiapkan sepenuhnya.
Untuk informasi lebih lanjut, lihat [Atribut DependsOn](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.html).
**Topics**
+ [Membuat kebijakan penskalaan untuk armada AppStream](#w2aac11c41c15c19b9)
+ [Buat kebijakan penskalaan untuk klaster Aurora DB](#w2aac11c41c15c19c11)
+ [Membuat kebijakan penskalaan untuk tabel DynamoDB](#w2aac11c41c15c19c13)
+ [Membuat kebijakan penskalaan untuk layanan Amazon ECS (metrik: CPU dan memori rata-rata)](#w2aac11c41c15c19c15)
+ [Membuat kebijakan penskalaan untuk layanan Amazon ECS (metrik: jumlah permintaan rata-rata per target)](#w2aac11c41c15c19c17)
+ [Buat tindakan terjadwal dengan ekspresi cron untuk fungsi Lambda](#w2aac11c41c15c19c19)
+ [Membuat tindakan terjadwal dengan `at` ekspresi untuk Armada Spot](#w2aac11c41c15c19c21)
## Membuat kebijakan penskalaan untuk armada AppStream
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-appstream-fleet.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-appstream-fleet.html)sumber daya menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html) [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html)Sumber daya mendeklarasikan target yang dapat diskalakan tempat kebijakan ini diterapkan. Application Auto Scaling dapat menskalakan jumlah instance armada minimal 1 instans dan maksimal 20 instans. Kebijakan tersebut menjaga pemanfaatan kapasitas rata-rata armada pada 75 persen, dengan periode cooldown scale-out dan scale-in 300 detik (5 menit).
Ini menggunakan fungsi `Fn::Join` dan `Rev` intrinsik untuk membangun `ResourceId` properti dengan nama logis dari `AWS::AppStream::Fleet` sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
### JSON
```
{
"Resources" : {
"ScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : 20,
"MinCapacity" : 1,
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet" },
"ServiceNamespace" : "appstream",
"ScalableDimension" : "appstream:fleet:DesiredCapacity",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"fleet",
{
"Ref" : "logicalName"
}
]
]
}
}
},
"ScalingPolicyAppStreamFleet" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : { "Fn::Sub" : "${AWS::StackName}-target-tracking-cpu75" },
"PolicyType" : "TargetTrackingScaling",
"ServiceNamespace" : "appstream",
"ScalableDimension" : "appstream:fleet:DesiredCapacity",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"fleet",
{
"Ref" : "logicalName"
}
]
]
},
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : 75,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "AppStreamAverageCapacityUtilization"
},
"ScaleInCooldown" : 300,
"ScaleOutCooldown" : 300
}
}
}
}
}
```
### YAML
```
---
Resources:
ScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 20
MinCapacity: 1
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/appstream.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_AppStreamFleet'
ServiceNamespace: appstream
ScalableDimension: appstream:fleet:DesiredCapacity
ResourceId: !Join
- /
- - fleet
- !Ref logicalName
ScalingPolicyAppStreamFleet:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: !Sub ${AWS::StackName}-target-tracking-cpu75
PolicyType: TargetTrackingScaling
ServiceNamespace: appstream
ScalableDimension: appstream:fleet:DesiredCapacity
ResourceId: !Join
- /
- - fleet
- !Ref logicalName
TargetTrackingScalingPolicyConfiguration:
TargetValue: 75
PredefinedMetricSpecification:
PredefinedMetricType: AppStreamAverageCapacityUtilization
ScaleInCooldown: 300
ScaleOutCooldown: 300
```
## Buat kebijakan penskalaan untuk klaster Aurora DB
Dalam cuplikan ini, Anda mendaftarkan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbcluster.html) [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html)Sumber daya menunjukkan bahwa cluster DB harus diskalakan secara dinamis untuk memiliki dari satu hingga delapan Replika Aurora. Anda juga menerapkan kebijakan penskalaan pelacakan target ke klaster menggunakan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html)sumber daya.
Dalam konfigurasi ini, metrik standar `RDSReaderAverageCPUUtilization` digunakan untuk menyesuaikan klaster DB Aurora berdasarkan pemanfaatan CPU rata-rata sebesar 40 persen di seluruh Replika Aurora dalam klaster DB Aurora tersebut. Konfigurasi ini menyediakan periode pendinginan penskalaan ke dalam selama 10 menit dan periode pendinginan penskalaan ke luar selama 5 menit.
Contoh ini menggunakan fungsi `Fn::Sub` intrinsik untuk membangun `ResourceId` properti dengan nama logis `AWS::RDS::DBCluster` sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
### JSON
```
{
"Resources" : {
"ScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : 8,
"MinCapacity" : 1,
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster" },
"ServiceNamespace" : "rds",
"ScalableDimension" : "rds:cluster:ReadReplicaCount",
"ResourceId" : { "Fn::Sub" : "cluster:${logicalName}" }
}
},
"ScalingPolicyDBCluster" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : { "Fn::Sub" : "${AWS::StackName}-target-tracking-cpu40" },
"PolicyType" : "TargetTrackingScaling",
"ServiceNamespace" : "rds",
"ScalableDimension" : "rds:cluster:ReadReplicaCount",
"ResourceId" : { "Fn::Sub" : "cluster:${logicalName}" },
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : 40,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "RDSReaderAverageCPUUtilization"
},
"ScaleInCooldown" : 600,
"ScaleOutCooldown" : 300
}
}
}
}
}
```
### YAML
```
---
Resources:
ScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 8
MinCapacity: 1
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/rds.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_RDSCluster'
ServiceNamespace: rds
ScalableDimension: rds:cluster:ReadReplicaCount
ResourceId: !Sub cluster:${logicalName}
ScalingPolicyDBCluster:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: !Sub ${AWS::StackName}-target-tracking-cpu40
PolicyType: TargetTrackingScaling
ServiceNamespace: rds
ScalableDimension: rds:cluster:ReadReplicaCount
ResourceId: !Sub cluster:${logicalName}
TargetTrackingScalingPolicyConfiguration:
TargetValue: 40
PredefinedMetricSpecification:
PredefinedMetricType: RDSReaderAverageCPUUtilization
ScaleInCooldown: 600
ScaleOutCooldown: 300
```
## Membuat kebijakan penskalaan untuk tabel DynamoDB
Cuplikan ini menunjukkan cara membuat kebijakan dengan tipe `TargetTrackingScaling` kebijakan dan menerapkannya ke [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-table.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-table.html)sumber daya menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html) [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html)Sumber daya menyatakan target yang dapat diskalakan yang diterapkan kebijakan ini, dengan minimal lima unit kapasitas tulis dan maksimum 15. Kebijakan penskalaan menskalakan throughput kapasitas tulis tabel untuk mempertahankan pemanfaatan target pada 50 persen berdasarkan metrik `DynamoDBWriteCapacityUtilization` yang sudah ditentukan sebelumnya.
Ini menggunakan fungsi `Fn::Join` dan `Ref` intrinsik untuk membangun `ResourceId` properti dengan nama logis dari `AWS::DynamoDB::Table` sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
**catatan**
Untuk informasi selengkapnya tentang cara membuat CloudFormation template untuk sumber daya DynamoDB, lihat [posting blog Cara menggunakan untuk mengonfigurasi penskalaan otomatis CloudFormation untuk tabel dan indeks Amazon DynamoDB di Blog Database](https://aws.amazon.com/blogs/database/how-to-use-aws-cloudformation-to-configure-auto-scaling-for-amazon-dynamodb-tables-and-indexes/). AWS
### JSON
```
{
"Resources" : {
"WriteCapacityScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : 15,
"MinCapacity" : 5,
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" },
"ServiceNamespace" : "dynamodb",
"ScalableDimension" : "dynamodb:table:WriteCapacityUnits",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"table",
{
"Ref" : "logicalName"
}
]
]
}
}
},
"WriteScalingPolicy" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : "WriteScalingPolicy",
"PolicyType" : "TargetTrackingScaling",
"ScalingTargetId" : { "Ref" : "WriteCapacityScalableTarget" },
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : 50.0,
"ScaleInCooldown" : 60,
"ScaleOutCooldown" : 60,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "DynamoDBWriteCapacityUtilization"
}
}
}
}
}
}
```
### YAML
```
---
Resources:
WriteCapacityScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 15
MinCapacity: 5
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable'
ServiceNamespace: dynamodb
ScalableDimension: dynamodb:table:WriteCapacityUnits
ResourceId: !Join
- /
- - table
- !Ref logicalName
WriteScalingPolicy:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: WriteScalingPolicy
PolicyType: TargetTrackingScaling
ScalingTargetId: !Ref WriteCapacityScalableTarget
TargetTrackingScalingPolicyConfiguration:
TargetValue: 50.0
ScaleInCooldown: 60
ScaleOutCooldown: 60
PredefinedMetricSpecification:
PredefinedMetricType: DynamoDBWriteCapacityUtilization
```
## Membuat kebijakan penskalaan untuk layanan Amazon ECS (metrik: CPU dan memori rata-rata)
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-service.html)sumber daya menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalingpolicy.html) [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html)Sumber daya mendeklarasikan target yang dapat diskalakan tempat kebijakan ini diterapkan. Application Auto Scaling dapat menskalakan jumlah tugas minimal 1 tugas dan maksimal 6.
Hal itu membuat dua kebijakan penskalaan dengan jenis kebijakan `TargetTrackingScaling`. Kebijakan yang digunakan untuk menskalakan layanan ECS berdasarkan penggunaan rata-rata CPU dan memori layanan. Ini menggunakan fungsi `Fn::Join` dan `Ref` intrinsik untuk membangun `ResourceId` properti dengan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-cluster.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ecs-cluster.html)(`myContainerCluster`) dan `AWS::ECS::Service` (`myService`) sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
### JSON
```
{
"Resources" : {
"ECSScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : "6",
"MinCapacity" : "1",
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" },
"ServiceNamespace" : "ecs",
"ScalableDimension" : "ecs:service:DesiredCount",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"service",
{
"Ref" : "myContainerCluster"
},
{
"Fn::GetAtt" : [
"myService",
"Name"
]
}
]
]
}
}
},
"ServiceScalingPolicyCPU" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : { "Fn::Sub" : "${AWS::StackName}-target-tracking-cpu70" },
"PolicyType" : "TargetTrackingScaling",
"ScalingTargetId" : { "Ref" : "ECSScalableTarget" },
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : 70.0,
"ScaleInCooldown" : 180,
"ScaleOutCooldown" : 60,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "ECSServiceAverageCPUUtilization"
}
}
}
},
"ServiceScalingPolicyMem" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : { "Fn::Sub" : "${AWS::StackName}-target-tracking-mem90" },
"PolicyType" : "TargetTrackingScaling",
"ScalingTargetId" : { "Ref" : "ECSScalableTarget" },
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : 90.0,
"ScaleInCooldown" : 180,
"ScaleOutCooldown" : 60,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "ECSServiceAverageMemoryUtilization"
}
}
}
}
}
}
```
### YAML
```
---
Resources:
ECSScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 6
MinCapacity: 1
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService'
ServiceNamespace: ecs
ScalableDimension: 'ecs:service:DesiredCount'
ResourceId: !Join
- /
- - service
- !Ref myContainerCluster
- !GetAtt myService.Name
ServiceScalingPolicyCPU:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: !Sub ${AWS::StackName}-target-tracking-cpu70
PolicyType: TargetTrackingScaling
ScalingTargetId: !Ref ECSScalableTarget
TargetTrackingScalingPolicyConfiguration:
TargetValue: 70.0
ScaleInCooldown: 180
ScaleOutCooldown: 60
PredefinedMetricSpecification:
PredefinedMetricType: ECSServiceAverageCPUUtilization
ServiceScalingPolicyMem:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: !Sub ${AWS::StackName}-target-tracking-mem90
PolicyType: TargetTrackingScaling
ScalingTargetId: !Ref ECSScalableTarget
TargetTrackingScalingPolicyConfiguration:
TargetValue: 90.0
ScaleInCooldown: 180
ScaleOutCooldown: 60
PredefinedMetricSpecification:
PredefinedMetricType: ECSServiceAverageMemoryUtilization
```
## Membuat kebijakan penskalaan untuk layanan Amazon ECS (metrik: jumlah permintaan rata-rata per target)
Contoh berikut menerapkan kebijakan penskalaan pelacakan target dengan metrik `ALBRequestCountPerTarget` yang telah ditetapkan ke layanan ECS. Kebijakan ini digunakan untuk menambah kapasitas layanan ECS ketika jumlah permintaan per target (per menit) melebihi nilai target. Karena nilai `DisableScaleIn` diatur menjadi `true`, kebijakan pelacakan target tidak akan menghapus kapasitas dari target yang dapat diskalakan.
Ini menggunakan fungsi `Fn::Join` dan `Fn::GetAtt` intrinsik untuk membangun `ResourceLabel` properti dengan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-loadbalancer.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-loadbalancer.html)(`myLoadBalancer`) dan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancingv2-targetgroup.html)(`myTargetGroup`) sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
Properti `MaxCapacity` dan `MinCapacity` pada target yang dapat diskalakan dan properti `TargetValue` nilai parameter referensi kebijakan penskalaan yang Anda teruskan ke templat saat membuat atau memperbarui tumpukan.
### JSON
```
{
"Resources" : {
"ECSScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : { "Ref" : "MaxCount" },
"MinCapacity" : { "Ref" : "MinCount" },
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService" },
"ServiceNamespace" : "ecs",
"ScalableDimension" : "ecs:service:DesiredCount",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"service",
{
"Ref" : "myContainerCluster"
},
{
"Fn::GetAtt" : [
"myService",
"Name"
]
}
]
]
}
}
},
"ServiceScalingPolicyALB" : {
"Type" : "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties" : {
"PolicyName" : "alb-requests-per-target-per-minute",
"PolicyType" : "TargetTrackingScaling",
"ScalingTargetId" : { "Ref" : "ECSScalableTarget" },
"TargetTrackingScalingPolicyConfiguration" : {
"TargetValue" : { "Ref" : "ALBPolicyTargetValue" },
"ScaleInCooldown" : 180,
"ScaleOutCooldown" : 30,
"DisableScaleIn" : true,
"PredefinedMetricSpecification" : {
"PredefinedMetricType" : "ALBRequestCountPerTarget",
"ResourceLabel" : {
"Fn::Join" : [
"/",
[
{
"Fn::GetAtt" : [
"myLoadBalancer",
"LoadBalancerFullName"
]
},
{
"Fn::GetAtt" : [
"myTargetGroup",
"TargetGroupFullName"
]
}
]
]
}
}
}
}
}
}
}
```
### YAML
```
---
Resources:
ECSScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: !Ref MaxCount
MinCapacity: !Ref MinCount
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ecs.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_ECSService'
ServiceNamespace: ecs
ScalableDimension: 'ecs:service:DesiredCount'
ResourceId: !Join
- /
- - service
- !Ref myContainerCluster
- !GetAtt myService.Name
ServiceScalingPolicyALB:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: alb-requests-per-target-per-minute
PolicyType: TargetTrackingScaling
ScalingTargetId: !Ref ECSScalableTarget
TargetTrackingScalingPolicyConfiguration:
TargetValue: !Ref ALBPolicyTargetValue
ScaleInCooldown: 180
ScaleOutCooldown: 30
DisableScaleIn: true
PredefinedMetricSpecification:
PredefinedMetricType: ALBRequestCountPerTarget
ResourceLabel: !Join
- '/'
- - !GetAtt myLoadBalancer.LoadBalancerFullName
- !GetAtt myTargetGroup.TargetGroupFullName
```
## Buat tindakan terjadwal dengan ekspresi cron untuk fungsi Lambda
Cuplikan ini mendaftarkan konkurensi yang disediakan untuk fungsi alias () bernama menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-alias.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-alias.html) Hal itu juga membuat tindakan terjadwal dengan jadwal berulang menggunakan ekspresi cron. Zona waktu untuk jadwal berulang adalah UTC.
Ini menggunakan fungsi `Ref` intrinsik `Fn::Join` dan intrinsik di `RoleARN` properti untuk menentukan ARN dari peran terkait layanan. Ini menggunakan fungsi `Fn::Sub` intrinsik untuk membangun `ResourceId` properti dengan nama logis dari [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html)atau [https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html](https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/sam-resource-function.html)sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
**catatan**
Anda tidak dapat mengalokasikan konkurensi yang disediakan pada alias yang menunjuk ke versi () yang tidak dipublikasikan. `$LATEST`
Untuk informasi selengkapnya tentang cara membuat CloudFormation template untuk sumber daya Lambda, lihat posting blog [Menjadwalkan Konkurensi Penyediaan AWS Lambda untuk](https://aws.amazon.com/blogs/compute/scheduling-aws-lambda-provisioned-concurrency-for-recurring-peak-usage/) penggunaan puncak berulang di Blog Komputasi. AWS
### JSON
```
{
"ScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : 250,
"MinCapacity" : 0,
"RoleARN" : {
"Fn::Join" : [
":",
[
"arn:aws:iam:",
{
"Ref" : "AWS::AccountId"
},
"role/aws-service-role/lambda.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_LambdaConcurrency"
]
]
},
"ServiceNamespace" : "lambda",
"ScalableDimension" : "lambda:function:ProvisionedConcurrency",
"ResourceId" : { "Fn::Sub" : "function:${logicalName}:BLUE" },
"ScheduledActions" : [
{
"ScalableTargetAction" : {
"MinCapacity" : "250"
},
"ScheduledActionName" : "my-scale-out-scheduled-action",
"Schedule" : "cron(0 18 * * ? *)",
"EndTime" : "2022-12-31T12:00:00.000Z"
}
]
}
}
}
```
### YAML
```
ScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 250
MinCapacity: 0
RoleARN: !Join
- ':'
- - 'arn:aws:iam:'
- !Ref 'AWS::AccountId'
- role/aws-service-role/lambda.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_LambdaConcurrency
ServiceNamespace: lambda
ScalableDimension: lambda:function:ProvisionedConcurrency
ResourceId: !Sub function:${logicalName}:BLUE
ScheduledActions:
- ScalableTargetAction:
MinCapacity: 250
ScheduledActionName: my-scale-out-scheduled-action
Schedule: 'cron(0 18 * * ? *)'
EndTime: '2022-12-31T12:00:00.000Z'
```
## Membuat tindakan terjadwal dengan `at` ekspresi untuk Armada Spot
Cuplikan ini menunjukkan cara membuat dua tindakan terjadwal yang terjadi hanya sekali untuk [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-spotfleet.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-spotfleet.html)sumber daya yang menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-applicationautoscaling-scalabletarget.html) Zona waktu untuk setiap tindakan terjadwal satu kali adalah UTC.
Ini menggunakan fungsi `Fn::Join` dan `Ref` intrinsik untuk membangun `ResourceId` properti dengan nama logis dari `AWS::EC2::SpotFleet` sumber daya yang ditentukan dalam template yang sama. Untuk informasi lebih lanjut, lihat Referensi [fungsi intrinsik](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html).
**catatan**
Permintaan Armada Spot harus memiliki jenis permintaan `maintain`. Penskalaan otomatis tidak didukung untuk permintaan tipe , atau blok Spot.
### JSON
```
{
"Resources" : {
"SpotFleetScalableTarget" : {
"Type" : "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties" : {
"MaxCapacity" : 0,
"MinCapacity" : 0,
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ec2.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_EC2SpotFleetRequest" },
"ServiceNamespace" : "ec2",
"ScalableDimension" : "ec2:spot-fleet-request:TargetCapacity",
"ResourceId" : {
"Fn::Join" : [
"/",
[
"spot-fleet-request",
{
"Ref" : "logicalName"
}
]
]
},
"ScheduledActions" : [
{
"ScalableTargetAction" : {
"MaxCapacity" : "10",
"MinCapacity" : "10"
},
"ScheduledActionName" : "my-scale-out-scheduled-action",
"Schedule" : "at(2022-05-20T13:00:00)"
},
{
"ScalableTargetAction" : {
"MaxCapacity" : "0",
"MinCapacity" : "0"
},
"ScheduledActionName" : "my-scale-in-scheduled-action",
"Schedule" : "at(2022-05-20T21:00:00)"
}
]
}
}
}
}
```
### YAML
```
---
Resources:
SpotFleetScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 0
MinCapacity: 0
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/ec2.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_EC2SpotFleetRequest'
ServiceNamespace: ec2
ScalableDimension: 'ec2:spot-fleet-request:TargetCapacity'
ResourceId: !Join
- /
- - spot-fleet-request
- !Ref logicalName
ScheduledActions:
- ScalableTargetAction:
MaxCapacity: 10
MinCapacity: 10
ScheduledActionName: my-scale-out-scheduled-action
Schedule: 'at(2022-05-20T13:00:00)'
- ScalableTargetAction:
MaxCapacity: 0
MinCapacity: 0
ScheduledActionName: my-scale-in-scheduled-action
Schedule: 'at(2022-05-20T21:00:00)'
```
# AWS Cuplikan templat Konsol Penagihan
Contoh ini membuat satu paket harga dengan aturan harga markup global 10%. Paket harga ini dilampirkan ke grup penagihan. Grup penagihan juga memiliki dua item baris khusus yang menerapkan biaya \$110 dan biaya 10% di atas total biaya grup penagihan.
## JSON
```
1. {
2. "Parameters": {
3. "LinkedAccountIds": {
4. "Type": "ListNumber"
5. },
6. "PrimaryAccountId": {
7. "Type": "Number"
8. }
9. },
10. "Resources": {
11. "TestPricingRule": {
12. "Type": "AWS::BillingConductor::PricingRule",
13. "Properties": {
14. "Name": "TestPricingRule",
15. "Description": "Test pricing rule created through Cloudformation. Mark everything by 10%.",
16. "Type": "MARKUP",
17. "Scope": "GLOBAL",
18. "ModifierPercentage": 10
19. }
20. },
21. "TestPricingPlan": {
22. "Type": "AWS::BillingConductor::PricingPlan",
23. "Properties": {
24. "Name": "TestPricingPlan",
25. "Description": "Test pricing plan created through Cloudformation.",
26. "PricingRuleArns": [
27. {"Fn::GetAtt": ["TestPricingRule", "Arn"]}
28. ]
29. }
30. },
31. "TestBillingGroup": {
32. "Type": "AWS::BillingConductor::BillingGroup",
33. "Properties": {
34. "Name": "TestBillingGroup",
35. "Description": "Test billing group created through Cloudformation with 1 linked account. The linked account is also the primary account.",
36. "PrimaryAccountId": {
37. "Ref": "PrimaryAccountId"
38. },
39. "AccountGrouping": {
40. "LinkedAccountIds": null
41. },
42. "ComputationPreference": {
43. "PricingPlanArn": {
44. "Fn::GetAtt": ["TestPricingPlan", "Arn"]
45. }
46. }
47. }
48. },
49. "TestFlatCustomLineItem": {
50. "Type": "AWS::BillingConductor::CustomLineItem",
51. "Properties": {
52. "Name": "TestFlatCustomLineItem",
53. "Description": "Test flat custom line item created through Cloudformation for a $10 charge.",
54. "BillingGroupArn": {
55. "Fn::GetAtt": ["TestBillingGroup", "Arn"]
56. },
57. "CustomLineItemChargeDetails": {
58. "Flat": {
59. "ChargeValue": 10
60. },
61. "Type": "FEE"
62. }
63. }
64. },
65. "TestPercentageCustomLineItem": {
66. "Type": "AWS::BillingConductor::CustomLineItem",
67. "Properties": {
68. "Name": "TestPercentageCustomLineItem",
69. "Description": "Test percentage custom line item created through Cloudformation for a %10 additional charge on the overall total bill of the billing group.",
70. "BillingGroupArn": {
71. "Fn::GetAtt": ["TestBillingGroup", "Arn"]
72. },
73. "CustomLineItemChargeDetails": {
74. "Percentage": {
75. "PercentageValue": 10,
76. "ChildAssociatedResources": [
77. {"Fn::GetAtt": ["TestBillingGroup", "Arn"]}
78. ]
79. },
80. "Type": "FEE"
81. }
82. }
83. }
84. }
85. }
```
## YAML
```
1. Parameters:
2. LinkedAccountIds:
3. Type: ListNumber
4. PrimaryAccountId:
5. Type: Number
6. Resources:
7. TestPricingRule:
8. Type: AWS::BillingConductor::PricingRule
9. Properties:
10. Name: 'TestPricingRule'
11. Description: 'Test pricing rule created through Cloudformation. Mark everything by 10%.'
12. Type: 'MARKUP'
13. Scope: 'GLOBAL'
14. ModifierPercentage: 10
15. TestPricingPlan:
16. Type: AWS::BillingConductor::PricingPlan
17. Properties:
18. Name: 'TestPricingPlan'
19. Description: 'Test pricing plan created through Cloudformation.'
20. PricingRuleArns:
21. - !GetAtt TestPricingRule.Arn
22. TestBillingGroup:
23. Type: AWS::BillingConductor::BillingGroup
24. Properties:
25. Name: 'TestBillingGroup'
26. Description: 'Test billing group created through Cloudformation with 1 linked account. The linked account is also the primary account.'
27. PrimaryAccountId: !Ref PrimaryAccountId
28. AccountGrouping:
29. LinkedAccountIds: !Ref LinkedAccountIds
30. ComputationPreference:
31. PricingPlanArn: !GetAtt TestPricingPlan.Arn
32. TestFlatCustomLineItem:
33. Type: AWS::BillingConductor::CustomLineItem
34. Properties:
35. Name: 'TestFlatCustomLineItem'
36. Description: 'Test flat custom line item created through Cloudformation for a $10 charge.'
37. BillingGroupArn: !GetAtt TestBillingGroup.Arn
38. CustomLineItemChargeDetails:
39. Flat:
40. ChargeValue: 10
41. Type: 'FEE'
42. TestPercentageCustomLineItem:
43. Type: AWS::BillingConductor::CustomLineItem
44. Properties:
45. Name: 'TestPercentageCustomLineItem'
46. Description: 'Test percentage custom line item created through Cloudformation for a %10 additional charge on the overall total bill of the billing group.'
47. BillingGroupArn: !GetAtt TestBillingGroup.Arn
48. CustomLineItemChargeDetails:
49. Percentage:
50. PercentageValue: 10
51. ChildAssociatedResources:
52. - !GetAtt TestBillingGroup.Arn
53. Type: 'FEE'
```
# CloudFormation cuplikan template
**Topics**
+ [Tumpukan nested](#w2aac11c41c23b5)
+ [Kondisi menunggu](#w2aac11c41c23b7)
## Tumpukan nested
### Membuat nest tumpukan dalam templat
Contoh templat ini mengandung sumber daya tumpukan nested yang disebut `myStack`. Ketika CloudFormation membuat tumpukan dari template, itu menciptakan`myStack`, yang templatnya ditentukan dalam `TemplateURL` properti. Nilai output `StackRef` mengembalikan ID tumpukan untuk `myStack` dan nilai `OutputFromNestedStack` mengembalikan nilai output `BucketName` dari dalam sumber daya `myStack`. `Outputs.nestedstackoutputname`Format ini dicadangkan untuk menentukan nilai output dari tumpukan bersarang dan dapat digunakan di mana saja dalam template yang berisi.
Untuk informasi selengkapnya, lihat [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-stack.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-stack.html).
#### JSON
```
1. {
2. "AWSTemplateFormatVersion" : "2010-09-09",
3. "Resources" : {
4. "myStack" : {
5. "Type" : "AWS::CloudFormation::Stack",
6. "Properties" : {
7. "TemplateURL" : "https://s3.amazonaws.com/cloudformation-templates-us-east-1/S3_Bucket.template",
8. "TimeoutInMinutes" : "60"
9. }
10. }
11. },
12. "Outputs": {
13. "StackRef": {"Value": { "Ref" : "myStack"}},
14. "OutputFromNestedStack" : {
15. "Value" : { "Fn::GetAtt" : [ "myStack", "Outputs.BucketName" ] }
16. }
17. }
18. }
```
#### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
2. Resources:
3. myStack:
4. Type: AWS::CloudFormation::Stack
5. Properties:
6. TemplateURL: https://s3.amazonaws.com/cloudformation-templates-us-east-1/S3_Bucket.template
7. TimeoutInMinutes: '60'
8. Outputs:
9. StackRef:
10. Value: !Ref myStack
11. OutputFromNestedStack:
12. Value: !GetAtt myStack.Outputs.BucketName
```
### Membuat nest tumpukan dengan parameter input dalam sebuah templat
Templat contoh ini berisi sumber daya tumpukan yang menentukan parameter input. Saat CloudFormation membuat tumpukan dari template ini, ia menggunakan pasangan nilai yang dideklarasikan dalam `Parameters` properti sebagai parameter input untuk template yang digunakan untuk membuat `myStackWithParams` tumpukan. Dalam contoh ini, parameter `InstanceType` dan `KeyName` ditentukan.
Untuk informasi selengkapnya, lihat [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-stack.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudformation-stack.html).
#### JSON
```
1. {
2. "AWSTemplateFormatVersion" : "2010-09-09",
3. "Resources" : {
4. "myStackWithParams" : {
5. "Type" : "AWS::CloudFormation::Stack",
6. "Properties" : {
7. "TemplateURL" : "https://s3.amazonaws.com/cloudformation-templates-us-east-1/EC2ChooseAMI.template",
8. "Parameters" : {
9. "InstanceType" : "t2.micro",
10. "KeyName" : "mykey"
11. }
12. }
13. }
14. }
15. }
```
#### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
2. Resources:
3. myStackWithParams:
4. Type: AWS::CloudFormation::Stack
5. Properties:
6. TemplateURL: https://s3.amazonaws.com/cloudformation-templates-us-east-1/EC2ChooseAMI.template
7. Parameters:
8. InstanceType: t2.micro
9. KeyName: mykey
```
## Kondisi menunggu
### Menggunakan kondisi tunggu dengan instans Amazon EC2
**penting**
Untuk sumber daya Amazon EC2 dan Auto Scaling, sebaiknya gunakan atribut alih-alih CreationPolicy kondisi tunggu. Tambahkan CreationPolicy atribut ke sumber daya tersebut, dan gunakan skrip pembantu sinyal cfn untuk memberi sinyal ketika proses pembuatan instance telah berhasil diselesaikan.
Jika Anda tidak dapat menggunakan kebijakan pembuatan, Anda akan melihat contoh template berikut, yang mendeklarasikan instans Amazon EC2 dengan kondisi tunggu. Kondisi `myWaitCondition` tunggu digunakan `myWaitConditionHandle` untuk pensinyalan, menggunakan `DependsOn` atribut untuk menentukan bahwa kondisi tunggu akan dipicu setelah sumber daya instans Amazon EC2 dibuat, dan menggunakan `Timeout` properti untuk menentukan durasi 4500 detik untuk kondisi tunggu. Selain itu, URL yang telah ditetapkan sebelumnya yang memberi sinyal kondisi tunggu diteruskan ke instans Amazon EC2 dengan `UserData` properti sumber daya, sehingga memungkinkan aplikasi atau skrip yang berjalan pada instans Amazon EC2 tersebut untuk mengambil URL yang telah ditetapkan sebelumnya dan menggunakannya untuk memberi sinyal keberhasilan atau kegagalan kondisi tunggu. `Ec2Instance` Anda perlu menggunakan `cfn-signal` atau membuat aplikasi atau skrip yang menandakan kondisi tunggu. Nilai output `ApplicationData` berisi data yang diteruskan kembali dari sinyal kondisi tunggu.
Untuk informasi selengkapnya, lihat [Buat kondisi tunggu di CloudFormation template](using-cfn-waitcondition.md).
#### JSON
```
1. {
2. "AWSTemplateFormatVersion" : "2010-09-09",
3. "Mappings" : {
4. "RegionMap" : {
5. "us-east-1" : {
6. "AMI" : "ami-0123456789abcdef0"
7. },
8. "us-west-1" : {
9. "AMI" : "ami-0987654321fedcba0"
10. },
11. "eu-west-1" : {
12. "AMI" : "ami-0abcdef123456789a"
13. },
14. "ap-northeast-1" : {
15. "AMI" : "ami-0fedcba987654321b"
16. },
17. "ap-southeast-1" : {
18. "AMI" : "ami-0c1d2e3f4a5b6c7d8"
19. }
20. }
21. },
22. "Resources" : {
23. "Ec2Instance" : {
24. "Type" : "AWS::EC2::Instance",
25. "Properties" : {
26. "UserData" : { "Fn::Base64" : {"Ref" : "myWaitHandle"}},
27. "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "AMI" ]}
28. }
29. },
30. "myWaitHandle" : {
31. "Type" : "AWS::CloudFormation::WaitConditionHandle",
32. "Properties" : {
33. }
34. },
35. "myWaitCondition" : {
36. "Type" : "AWS::CloudFormation::WaitCondition",
37. "DependsOn" : "Ec2Instance",
38. "Properties" : {
39. "Handle" : { "Ref" : "myWaitHandle" },
40. "Timeout" : "4500"
41. }
42. }
43. },
44. "Outputs" : {
45. "ApplicationData" : {
46. "Value" : { "Fn::GetAtt" : [ "myWaitCondition", "Data" ]},
47. "Description" : "The data passed back as part of signalling the WaitCondition."
48. }
49. }
50. }
```
#### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
2. Mappings:
3. RegionMap:
4. us-east-1:
5. AMI: ami-0123456789abcdef0
6. us-west-1:
7. AMI: ami-0987654321fedcba0
8. eu-west-1:
9. AMI: ami-0abcdef123456789a
10. ap-northeast-1:
11. AMI: ami-0fedcba987654321b
12. ap-southeast-1:
13. AMI: ami-0c1d2e3f4a5b6c7d8
14. Resources:
15. Ec2Instance:
16. Type: AWS::EC2::Instance
17. Properties:
18. UserData:
19. Fn::Base64: !Ref myWaitHandle
20. ImageId:
21. Fn::FindInMap:
22. - RegionMap
23. - Ref: AWS::Region
24. - AMI
25. myWaitHandle:
26. Type: AWS::CloudFormation::WaitConditionHandle
27. Properties: {}
28. myWaitCondition:
29. Type: AWS::CloudFormation::WaitCondition
30. DependsOn: Ec2Instance
31. Properties:
32. Handle: !Ref myWaitHandle
33. Timeout: '4500'
34. Outputs:
35. ApplicationData:
36. Value: !GetAtt myWaitCondition.Data
37. Description: The data passed back as part of signalling the WaitCondition.
```
### Menggunakan skrip pembantu cfn-signal untuk memberi sinyal kondisi menunggu
Contoh ini menunjukkan baris `cfn-signal` perintah yang menandakan keberhasilan untuk kondisi menunggu. Anda harus menentukan baris perintah di properti `UserData` instans EC2.
#### JSON
```
"UserData": {
"Fn::Base64": {
"Fn::Join": [
"",
[
"#!/bin/bash -xe\n",
"/opt/aws/bin/cfn-signal --exit-code 0 '",
{
"Ref": "myWaitHandle"
},
"'\n"
]
]
}
}
```
#### YAML
```
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
/opt/aws/bin/cfn-signal --exit-code 0 '${myWaitHandle}'
```
### Menggunakan Curl untuk memberikan sinyal kondisi menunggu
Contoh ini menunjukkan baris perintah Curl yang memberikan sinyal berhasil ke kondisi menunggu.
```
1. curl -T /tmp/a "https://cloudformation-waitcondition-test.s3.amazonaws.com/arn%3Aaws%3Acloudformation%3Aus-east-1%3A034017226601%3Astack%2Fstack-gosar-20110427004224-test-stack-with-WaitCondition--VEYW%2Fe498ce60-70a1-11e0-81a7-5081d0136786%2FmyWaitConditionHandle?Expires=1303976584&AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&Signature=ik1twT6hpS4cgNAw7wyOoRejVoo%3D"
```
Tempat file /tmp/a mengandung struktur JSON berikut:
```
1. {
2. "Status" : "SUCCESS",
3. "Reason" : "Configuration Complete",
4. "UniqueId" : "ID1234",
5. "Data" : "Application has completed configuration."
6. }
```
Contoh ini menunjukkan baris perintah Curl yang mengirimkan sinyal berhasil yang sama tetapi mengirimkan JSON sebagai parameter pada baris perintah.
```
1. curl -X PUT -H 'Content-Type:' --data-binary '{"Status" : "SUCCESS","Reason" : "Configuration Complete","UniqueId" : "ID1234","Data" : "Application has completed configuration."}' "https://cloudformation-waitcondition-test.s3.amazonaws.com/arn%3Aaws%3Acloudformation%3Aus-east-1%3A034017226601%3Astack%2Fstack-gosar-20110427004224-test-stack-with-WaitCondition--VEYW%2Fe498ce60-70a1-11e0-81a7-5081d0136786%2FmyWaitConditionHandle?Expires=1303976584&AWSAccessKeyId=AKIAIOSFODNN7EXAMPLE&Signature=ik1twT6hpS4cgNAw7wyOoRejVoo%3D"
```
# Cuplikan CloudFront template Amazon
Gunakan contoh cuplikan templat ini dengan sumber daya CloudFront distribusi Amazon Anda di. CloudFormation Untuk informasi selengkapnya, lihat [referensi jenis CloudFront sumber daya Amazon](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/AWS_CloudFront.html).
**Topics**
+ [Sumber daya CloudFront distribusi Amazon dengan asal Amazon S3](#scenario-cloudfront-s3origin)
+ [Sumber daya CloudFront distribusi Amazon dengan asal kustom](#scenario-cloudfront-customorigin)
+ [CloudFront Distribusi Amazon dengan dukungan multi-asal](#scenario-cloudfront-multiorigin)
+ [CloudFront Distribusi Amazon dengan fungsi Lambda sebagai asal](#scenario-cloudfront-lambda-origin)
+ [Lihat juga](#w2aac11c41c27c15)
## Sumber daya CloudFront distribusi Amazon dengan asal Amazon S3
Contoh template berikut menunjukkan CloudFront [Distribusi](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudfront-distribution.html) Amazon menggunakan [S3Origin dan identitas akses asal](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-distribution-s3originconfig.html) lama (OAI). Untuk informasi tentang menggunakan kontrol akses asal (OAC) sebagai gantinya, lihat [Membatasi akses ke asal Layanan Penyimpanan Sederhana Amazon di Panduan CloudFront](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) *Pengembang Amazon*.
### JSON
```
1. {
2. "AWSTemplateFormatVersion" : "2010-09-09",
3. "Resources" : {
4. "myDistribution" : {
5. "Type" : "AWS::CloudFront::Distribution",
6. "Properties" : {
7. "DistributionConfig" : {
8. "Origins" : [ {
9. "DomainName" : "amzn-s3-demo-bucket.s3.amazonaws.com",
10. "Id" : "myS3Origin",
11. "S3OriginConfig" : {
12. "OriginAccessIdentity" : "origin-access-identity/cloudfront/E127EXAMPLE51Z"
13. }
14. }],
15. "Enabled" : "true",
16. "Comment" : "Some comment",
17. "DefaultRootObject" : "index.html",
18. "Logging" : {
19. "IncludeCookies" : "false",
20. "Bucket" : "amzn-s3-demo-logging-bucket.s3.amazonaws.com",
21. "Prefix" : "myprefix"
22. },
23. "Aliases" : [ "mysite.example.com", "yoursite.example.com" ],
24. "DefaultCacheBehavior" : {
25. "AllowedMethods" : [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ],
26. "TargetOriginId" : "myS3Origin",
27. "ForwardedValues" : {
28. "QueryString" : "false",
29. "Cookies" : { "Forward" : "none" }
30. },
31. "TrustedSigners" : [ "1234567890EX", "1234567891EX" ],
32. "ViewerProtocolPolicy" : "allow-all"
33. },
34. "PriceClass" : "PriceClass_200",
35. "Restrictions" : {
36. "GeoRestriction" : {
37. "RestrictionType" : "whitelist",
38. "Locations" : [ "AQ", "CV" ]
39. }
40. },
41. "ViewerCertificate" : { "CloudFrontDefaultCertificate" : "true" }
42. }
43. }
44. }
45. }
46. }
```
### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
2. Resources:
3. myDistribution:
4. Type: AWS::CloudFront::Distribution
5. Properties:
6. DistributionConfig:
7. Origins:
8. - DomainName: amzn-s3-demo-bucket.s3.amazonaws.com
9. Id: myS3Origin
10. S3OriginConfig:
11. OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z
12. Enabled: 'true'
13. Comment: Some comment
14. DefaultRootObject: index.html
15. Logging:
16. IncludeCookies: 'false'
17. Bucket: amzn-s3-demo-logging-bucket.s3.amazonaws.com
18. Prefix: myprefix
19. Aliases:
20. - mysite.example.com
21. - yoursite.example.com
22. DefaultCacheBehavior:
23. AllowedMethods:
24. - DELETE
25. - GET
26. - HEAD
27. - OPTIONS
28. - PATCH
29. - POST
30. - PUT
31. TargetOriginId: myS3Origin
32. ForwardedValues:
33. QueryString: 'false'
34. Cookies:
35. Forward: none
36. TrustedSigners:
37. - 1234567890EX
38. - 1234567891EX
39. ViewerProtocolPolicy: allow-all
40. PriceClass: PriceClass_200
41. Restrictions:
42. GeoRestriction:
43. RestrictionType: whitelist
44. Locations:
45. - AQ
46. - CV
47. ViewerCertificate:
48. CloudFrontDefaultCertificate: 'true'
```
## Sumber daya CloudFront distribusi Amazon dengan asal kustom
Contoh template berikut menunjukkan CloudFront [Distribusi](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudfront-distribution.html) Amazon menggunakan file [CustomOrigin](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-distribution-customoriginconfig.html).
### JSON
```
1. {
2. "AWSTemplateFormatVersion" : "2010-09-09",
3. "Resources" : {
4. "myDistribution" : {
5. "Type" : "AWS::CloudFront::Distribution",
6. "Properties" : {
7. "DistributionConfig" : {
8. "Origins" : [ {
9. "DomainName" : "www.example.com",
10. "Id" : "myCustomOrigin",
11. "CustomOriginConfig" : {
12. "HTTPPort" : "80",
13. "HTTPSPort" : "443",
14. "OriginProtocolPolicy" : "http-only"
15. }
16. } ],
17. "Enabled" : "true",
18. "Comment" : "Somecomment",
19. "DefaultRootObject" : "index.html",
20. "Logging" : {
21. "IncludeCookies" : "true",
22. "Bucket" : "amzn-s3-demo-logging-bucket.s3.amazonaws.com",
23. "Prefix": "myprefix"
24. },
25. "Aliases" : [
26. "mysite.example.com",
27. "*.yoursite.example.com"
28. ],
29. "DefaultCacheBehavior" : {
30. "TargetOriginId" : "myCustomOrigin",
31. "SmoothStreaming" : "false",
32. "ForwardedValues" : {
33. "QueryString" : "false",
34. "Cookies" : { "Forward" : "all" }
35. },
36. "TrustedSigners" : [
37. "1234567890EX",
38. "1234567891EX"
39. ],
40. "ViewerProtocolPolicy" : "allow-all"
41. },
42. "CustomErrorResponses" : [ {
43. "ErrorCode" : "404",
44. "ResponsePagePath" : "/error-pages/404.html",
45. "ResponseCode" : "200",
46. "ErrorCachingMinTTL" : "30"
47. } ],
48. "PriceClass" : "PriceClass_200",
49. "Restrictions" : {
50. "GeoRestriction" : {
51. "RestrictionType" : "whitelist",
52. "Locations" : [ "AQ", "CV" ]
53. }
54. },
55. "ViewerCertificate": { "CloudFrontDefaultCertificate" : "true" }
56. }
57. }
58. }
59. }
60. }
```
### YAML
```
1. AWSTemplateFormatVersion: '2010-09-09'
2. Resources:
3. myDistribution:
4. Type: AWS::CloudFront::Distribution
5. Properties:
6. DistributionConfig:
7. Origins:
8. - DomainName: www.example.com
9. Id: myCustomOrigin
10. CustomOriginConfig:
11. HTTPPort: '80'
12. HTTPSPort: '443'
13. OriginProtocolPolicy: http-only
14. Enabled: 'true'
15. Comment: Somecomment
16. DefaultRootObject: index.html
17. Logging:
18. IncludeCookies: 'true'
19. Bucket: amzn-s3-demo-logging-bucket.s3.amazonaws.com
20. Prefix: myprefix
21. Aliases:
22. - mysite.example.com
23. - "*.yoursite.example.com"
24. DefaultCacheBehavior:
25. TargetOriginId: myCustomOrigin
26. SmoothStreaming: 'false'
27. ForwardedValues:
28. QueryString: 'false'
29. Cookies:
30. Forward: all
31. TrustedSigners:
32. - 1234567890EX
33. - 1234567891EX
34. ViewerProtocolPolicy: allow-all
35. CustomErrorResponses:
36. - ErrorCode: '404'
37. ResponsePagePath: "/error-pages/404.html"
38. ResponseCode: '200'
39. ErrorCachingMinTTL: '30'
40. PriceClass: PriceClass_200
41. Restrictions:
42. GeoRestriction:
43. RestrictionType: whitelist
44. Locations:
45. - AQ
46. - CV
47. ViewerCertificate:
48. CloudFrontDefaultCertificate: 'true'
```
## CloudFront Distribusi Amazon dengan dukungan multi-asal
Contoh template berikut menunjukkan cara mendeklarasikan CloudFront [Distribusi dengan dukungan](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudfront-distribution.html) multi-asal. Dalam [DistributionConfig](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-distribution-distributionconfig.html), daftar asal disediakan dan a [DefaultCacheBehavior](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudfront-distribution-defaultcachebehavior.html)ditetapkan.
### JSON
```
{
"AWSTemplateFormatVersion" : "2010-09-09",
"Resources" : {
"myDistribution" : {
"Type" : "AWS::CloudFront::Distribution",
"Properties" : {
"DistributionConfig" : {
"Origins" : [ {
"Id" : "myS3Origin",
"DomainName" : "amzn-s3-demo-bucket.s3.amazonaws.com",
"S3OriginConfig" : {
"OriginAccessIdentity" : "origin-access-identity/cloudfront/E127EXAMPLE51Z"
}
},
{
"Id" : "myCustomOrigin",
"DomainName" : "www.example.com",
"CustomOriginConfig" : {
"HTTPPort" : "80",
"HTTPSPort" : "443",
"OriginProtocolPolicy" : "http-only"
}
}
],
"Enabled" : "true",
"Comment" : "Some comment",
"DefaultRootObject" : "index.html",
"Logging" : {
"IncludeCookies" : "true",
"Bucket" : "amzn-s3-demo-logging-bucket.s3.amazonaws.com",
"Prefix" : "myprefix"
},
"Aliases" : [ "mysite.example.com", "yoursite.example.com" ],
"DefaultCacheBehavior" : {
"TargetOriginId" : "myS3Origin",
"ForwardedValues" : {
"QueryString" : "false",
"Cookies" : { "Forward" : "all" }
},
"TrustedSigners" : [ "1234567890EX", "1234567891EX" ],
"ViewerProtocolPolicy" : "allow-all",
"MinTTL" : "100",
"SmoothStreaming" : "true"
},
"CacheBehaviors" : [ {
"AllowedMethods" : [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ],
"TargetOriginId" : "myS3Origin",
"ForwardedValues" : {
"QueryString" : "true",
"Cookies" : { "Forward" : "none" }
},
"TrustedSigners" : [ "1234567890EX", "1234567891EX" ],
"ViewerProtocolPolicy" : "allow-all",
"MinTTL" : "50",
"PathPattern" : "images1/*.jpg"
},
{
"AllowedMethods" : [ "DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT" ],
"TargetOriginId" : "myCustomOrigin",
"ForwardedValues" : {
"QueryString" : "true",
"Cookies" : { "Forward" : "none" }
},
"TrustedSigners" : [ "1234567890EX", "1234567891EX" ],
"ViewerProtocolPolicy" : "allow-all",
"MinTTL" : "50",
"PathPattern" : "images2/*.jpg"
}
],
"CustomErrorResponses" : [ {
"ErrorCode" : "404",
"ResponsePagePath" : "/error-pages/404.html",
"ResponseCode" : "200",
"ErrorCachingMinTTL" : "30"
} ],
"PriceClass" : "PriceClass_All",
"ViewerCertificate" : { "CloudFrontDefaultCertificate" : "true" }
}
}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
myDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
Origins:
- Id: myS3Origin
DomainName: amzn-s3-demo-bucket.s3.amazonaws.com
S3OriginConfig:
OriginAccessIdentity: origin-access-identity/cloudfront/E127EXAMPLE51Z
- Id: myCustomOrigin
DomainName: www.example.com
CustomOriginConfig:
HTTPPort: '80'
HTTPSPort: '443'
OriginProtocolPolicy: http-only
Enabled: 'true'
Comment: Some comment
DefaultRootObject: index.html
Logging:
IncludeCookies: 'true'
Bucket: amzn-s3-demo-logging-bucket.s3.amazonaws.com
Prefix: myprefix
Aliases:
- mysite.example.com
- yoursite.example.com
DefaultCacheBehavior:
TargetOriginId: myS3Origin
ForwardedValues:
QueryString: 'false'
Cookies:
Forward: all
TrustedSigners:
- 1234567890EX
- 1234567891EX
ViewerProtocolPolicy: allow-all
MinTTL: '100'
SmoothStreaming: 'true'
CacheBehaviors:
- AllowedMethods:
- DELETE
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
TargetOriginId: myS3Origin
ForwardedValues:
QueryString: 'true'
Cookies:
Forward: none
TrustedSigners:
- 1234567890EX
- 1234567891EX
ViewerProtocolPolicy: allow-all
MinTTL: '50'
PathPattern: images1/*.jpg
- AllowedMethods:
- DELETE
- GET
- HEAD
- OPTIONS
- PATCH
- POST
- PUT
TargetOriginId: myCustomOrigin
ForwardedValues:
QueryString: 'true'
Cookies:
Forward: none
TrustedSigners:
- 1234567890EX
- 1234567891EX
ViewerProtocolPolicy: allow-all
MinTTL: '50'
PathPattern: images2/*.jpg
CustomErrorResponses:
- ErrorCode: '404'
ResponsePagePath: "/error-pages/404.html"
ResponseCode: '200'
ErrorCachingMinTTL: '30'
PriceClass: PriceClass_All
ViewerCertificate:
CloudFrontDefaultCertificate: 'true'
```
## CloudFront Distribusi Amazon dengan fungsi Lambda sebagai asal
Contoh berikut membuat CloudFront distribusi yang menampilkan URL fungsi Lambda tertentu (disediakan sebagai parameter), memungkinkan akses khusus HTTP, caching, kompresi, dan pengiriman global. Ini mengonfigurasi URL Lambda sebagai asal HTTPS khusus dan menerapkan kebijakan caching AWS standar. Distribusi dioptimalkan untuk kinerja dengan HTTP/2 dan IPv6 mendukung dan mengeluarkan nama CloudFront domain, memungkinkan pengguna untuk mengakses fungsi Lambda melalui titik akhir yang aman dan didukung CDN-nya. Untuk informasi selengkapnya, lihat [Menggunakan Amazon CloudFront dengan AWS Lambda sebagai asal untuk mempercepat aplikasi web Anda](https://aws.amazon.com/blogs/networking-and-content-delivery/using-amazon-cloudfront-with-aws-lambda-as-origin-to-accelerate-your-web-applications/) di AWS Blog.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"LambdaEndpoint": {
"Type": "String",
"Description": "The Lambda function URL endpoint without the 'https://'"
}
},
"Resources": {
"MyDistribution": {
"Type": "AWS::CloudFront::Distribution",
"Properties": {
"DistributionConfig": {
"PriceClass": "PriceClass_All",
"HttpVersion": "http2",
"IPV6Enabled": true,
"Origins": [
{
"DomainName": {
"Ref": "LambdaEndpoint"
},
"Id": "LambdaOrigin",
"CustomOriginConfig": {
"HTTPSPort": 443,
"OriginProtocolPolicy": "https-only"
}
}
],
"Enabled": "true",
"DefaultCacheBehavior": {
"TargetOriginId": "LambdaOrigin",
"CachePolicyId": "658327ea-f89d-4fab-a63d-7e88639e58f6",
"ViewerProtocolPolicy": "redirect-to-https",
"SmoothStreaming": "false",
"Compress": "true"
}
}
}
}
},
"Outputs": {
"CloudFrontDomain": {
"Description": "CloudFront default domain name configured",
"Value": {
"Fn::Sub": "https://${MyDistribution.DomainName}/"
}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
LambdaEndpoint:
Type: String
Description: The Lambda function URL endpoint without the 'https://'
Resources:
MyDistribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
PriceClass: PriceClass_All
HttpVersion: http2
IPV6Enabled: true
Origins:
- DomainName: !Ref LambdaEndpoint
Id: LambdaOrigin
CustomOriginConfig:
HTTPSPort: 443
OriginProtocolPolicy: https-only
Enabled: 'true'
DefaultCacheBehavior:
TargetOriginId: LambdaOrigin
CachePolicyId: '658327ea-f89d-4fab-a63d-7e88639e58f6'
ViewerProtocolPolicy: redirect-to-https
SmoothStreaming: 'false'
Compress: 'true'
Outputs:
CloudFrontDomain:
Description: CloudFront default domain name configured
Value: !Sub https://${MyDistribution.DomainName}/
```
## Lihat juga
Untuk contoh menambahkan alias kustom ke catatan Route 53 untuk membuat nama ramah untuk CloudFront distribusi, lihat[Catatan sumber daya alias ditetapkan untuk distribusi CloudFront](quickref-route53.md#scenario-user-friendly-url-for-cloudfront-distribution).
# Cuplikan CloudWatch template Amazon
Gunakan contoh cuplikan templat ini untuk membantu mendeskripsikan CloudWatch sumber daya Amazon Anda. CloudFormation Untuk informasi selengkapnya, lihat [referensi jenis CloudWatch sumber daya Amazon](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/AWS_CloudWatch.html).
**Topics**
+ [Alarm penagihan](#cloudwatch-sample-billing-alarm)
+ [Alarm penggunaan CPU](#cloudwatch-sample-cpu-utilization-alarm)
+ [Memulihkan instans Amazon Elastic Compute Cloud](#cloudwatch-sample-recover-instance)
+ [Membuat dasbor dasar](#cloudwatch-sample-dashboard-basic)
+ [Buat dasbor dengan side-by-side widget](#cloudwatch-sample-dashboard-sidebyside)
## Alarm penagihan
Dalam contoh berikut, Amazon CloudWatch mengirimkan pemberitahuan email ketika tagihan ke AWS akun Anda melebihi ambang batas alarm. Untuk menerima notifikasi penggunaan, aktifkan peringatan penagihan. Untuk informasi selengkapnya, lihat [Membuat alarm penagihan untuk memantau perkiraan AWS tagihan Anda](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html) di *Panduan CloudWatch Pengguna Amazon*. >
### JSON
```
"SpendingAlarm": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": { "Fn::Join": ["", [
"Alarm if AWS spending is over $",
{ "Ref": "AlarmThreshold" }
]]},
"Namespace": "AWS/Billing",
"MetricName": "EstimatedCharges",
"Dimensions": [{
"Name": "Currency",
"Value" : "USD"
}],
"Statistic": "Maximum",
"Period": "21600",
"EvaluationPeriods": "1",
"Threshold": { "Ref": "AlarmThreshold" },
"ComparisonOperator": "GreaterThanThreshold",
"AlarmActions": [{
"Ref": "BillingAlarmNotification"
}],
"InsufficientDataActions": [{
"Ref": "BillingAlarmNotification"
}]
}
}
```
### YAML
```
SpendingAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmDescription:
'Fn::Join':
- ''
- - Alarm if AWS spending is over $
- !Ref: AlarmThreshold
Namespace: AWS/Billing
MetricName: EstimatedCharges
Dimensions:
- Name: Currency
Value: USD
Statistic: Maximum
Period: '21600'
EvaluationPeriods: '1'
Threshold:
!Ref: "AlarmThreshold"
ComparisonOperator: GreaterThanThreshold
AlarmActions:
- !Ref: "BillingAlarmNotification"
InsufficientDataActions:
- !Ref: "BillingAlarmNotification"
```
## Alarm penggunaan CPU
Contoh cuplikan berikut membuat alarm yang mengirimkan pemberitahuan ketika penggunaan CPU rata-rata instans Amazon EC2 melebihi 90 persen selama lebih dari 60 detik selama tiga periode evaluasi.
### JSON
```
1. "CPUAlarm" : {
2. "Type" : "AWS::CloudWatch::Alarm",
3. "Properties" : {
4. "AlarmDescription" : "CPU alarm for my instance",
5. "AlarmActions" : [ { "Ref" : "logical name of an AWS::SNS::Topic resource" } ],
6. "MetricName" : "CPUUtilization",
7. "Namespace" : "AWS/EC2",
8. "Statistic" : "Average",
9. "Period" : "60",
10. "EvaluationPeriods" : "3",
11. "Threshold" : "90",
12. "ComparisonOperator" : "GreaterThanThreshold",
13. "Dimensions" : [ {
14. "Name" : "InstanceId",
15. "Value" : { "Ref" : "logical name of an AWS::EC2::Instance resource" }
16. } ]
17. }
18. }
```
### YAML
```
1. CPUAlarm:
2. Type: AWS::CloudWatch::Alarm
3. Properties:
4. AlarmDescription: CPU alarm for my instance
5. AlarmActions:
6. - !Ref: "logical name of an AWS::SNS::Topic resource"
7. MetricName: CPUUtilization
8. Namespace: AWS/EC2
9. Statistic: Average
10. Period: '60'
11. EvaluationPeriods: '3'
12. Threshold: '90'
13. ComparisonOperator: GreaterThanThreshold
14. Dimensions:
15. - Name: InstanceId
16. Value: !Ref: "logical name of an AWS::EC2::Instance resource"
```
## Memulihkan instans Amazon Elastic Compute Cloud
CloudWatch Alarm berikut memulihkan instans EC2 ketika mengalami kegagalan pemeriksaan status selama 15 menit berturut-turut. Untuk informasi selengkapnya tentang tindakan alarm, lihat [Membuat alarm untuk menghentikan, menghentikan, mem-boot ulang, atau memulihkan instans EC2 di Panduan](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/UsingAlarmActions.html) Pengguna *Amazon CloudWatch *.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters" : {
"RecoveryInstance" : {
"Description" : "The EC2 instance ID to associate this alarm with.",
"Type" : "AWS::EC2::Instance::Id"
}
},
"Resources": {
"RecoveryTestAlarm": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "Trigger a recovery when instance status check fails for 15 consecutive minutes.",
"Namespace": "AWS/EC2" ,
"MetricName": "StatusCheckFailed_System",
"Statistic": "Minimum",
"Period": "60",
"EvaluationPeriods": "15",
"ComparisonOperator": "GreaterThanThreshold",
"Threshold": "0",
"AlarmActions": [ {"Fn::Join" : ["", ["arn:aws:automate:", { "Ref" : "AWS::Region" }, ":ec2:recover" ]]} ],
"Dimensions": [{"Name": "InstanceId","Value": {"Ref": "RecoveryInstance"}}]
}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
RecoveryInstance:
Description: The EC2 instance ID to associate this alarm with.
Type: AWS::EC2::Instance::Id
Resources:
RecoveryTestAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmDescription: Trigger a recovery when instance status check fails for 15
consecutive minutes.
Namespace: AWS/EC2
MetricName: StatusCheckFailed_System
Statistic: Minimum
Period: '60'
EvaluationPeriods: '15'
ComparisonOperator: GreaterThanThreshold
Threshold: '0'
AlarmActions: [ !Sub "arn:aws:automate:${AWS::Region}:ec2:recover" ]
Dimensions:
- Name: InstanceId
Value: !Ref: RecoveryInstance
```
## Membuat dasbor dasar
Contoh berikut membuat CloudWatch dasbor sederhana dengan satu widget metrik yang menampilkan pemanfaatan CPU, dan satu widget teks menampilkan pesan.
### JSON
```
{
"BasicDashboard": {
"Type": "AWS::CloudWatch::Dashboard",
"Properties": {
"DashboardName": "Dashboard1",
"DashboardBody": "{\"widgets\":[{\"type\":\"metric\",\"x\":0,\"y\":0,\"width\":12,\"height\":6,\"properties\":{\"metrics\":[[\"AWS/EC2\",\"CPUUtilization\",\"InstanceId\",\"i-012345\"]],\"period\":300,\"stat\":\"Average\",\"region\":\"us-east-1\",\"title\":\"EC2 Instance CPU\"}},{\"type\":\"text\",\"x\":0,\"y\":7,\"width\":3,\"height\":3,\"properties\":{\"markdown\":\"Hello world\"}}]}"
}
}
}
```
### YAML
```
BasicDashboard:
Type: AWS::CloudWatch::Dashboard
Properties:
DashboardName: Dashboard1
DashboardBody: '{"widgets":[{"type":"metric","x":0,"y":0,"width":12,"height":6,"properties":{"metrics":[["AWS/EC2","CPUUtilization","InstanceId","i-012345"]],"period":300,"stat":"Average","region":"us-east-1","title":"EC2 Instance CPU"}},{"type":"text","x":0,"y":7,"width":3,"height":3,"properties":{"markdown":"Hello world"}}]}'
```
## Buat dasbor dengan side-by-side widget
Contoh berikut membuat dasbor dengan dua widget metrik yang muncul berdampingan.
### JSON
```
{
"DashboardSideBySide": {
"Type": "AWS::CloudWatch::Dashboard",
"Properties": {
"DashboardName": "Dashboard1",
"DashboardBody": "{\"widgets\":[{\"type\":\"metric\",\"x\":0,\"y\":0,\"width\":12,\"height\":6,\"properties\":{\"metrics\":[[\"AWS/EC2\",\"CPUUtilization\",\"InstanceId\",\"i-012345\"]],\"period\":300,\"stat\":\"Average\",\"region\":\"us-east-1\",\"title\":\"EC2 Instance CPU\"}},{\"type\":\"metric\",\"x\":12,\"y\":0,\"width\":12,\"height\":6,\"properties\":{\"metrics\":[[\"AWS/S3\",\"BucketSizeBytes\",\"BucketName\",\"amzn-s3-demo-bucket\"]],\"period\":86400,\"stat\":\"Maximum\",\"region\":\"us-east-1\",\"title\":\"amzn-s3-demo-bucket bytes\"}}]}"
}
}
}
```
### YAML
```
DashboardSideBySide:
Type: AWS::CloudWatch::Dashboard
Properties:
DashboardName: Dashboard1
DashboardBody: '{"widgets":[{"type":"metric","x":0,"y":0,"width":12,"height":6,"properties":{"metrics":[["AWS/EC2","CPUUtilization","InstanceId","i-012345"]],"period":300,"stat":"Average","region":"us-east-1","title":"EC2 Instance CPU"}},{"type":"metric","x":12,"y":0,"width":12,"height":6,"properties":{"metrics":[["AWS/S3","BucketSizeBytes","BucketName","amzn-s3-demo-bucket"]],"period":86400,"stat":"Maximum","region":"us-east-1","title":"amzn-s3-demo-bucket bytes"}}]}'
```
# Cuplikan templat Amazon CloudWatch Log
Amazon CloudWatch Logs dapat memantau sistem, aplikasi, dan file log kustom Anda dari instans Amazon EC2 atau sumber lain. Anda dapat menggunakan CloudFormation untuk menyediakan dan mengelola grup log dan filter metrik. Untuk informasi selengkapnya tentang CloudWatch Log Amazon, lihat [Panduan Pengguna CloudWatch Log Amazon](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html).
**Topics**
+ [Kirim CloudWatch log ke Log dari instance Linux](#quickref-cloudwatchlogs-example1)
+ [Kirim CloudWatch log ke Log dari instance Windows](#quickref-cloudwatchlogs-example2)
+ [Lihat juga](#w2aac11c41c35c11)
## Kirim CloudWatch log ke Log dari instance Linux
Template berikut menunjukkan cara mengatur server web di Amazon Linux 2023 dengan integrasi CloudWatch Log. Template melakukan tugas-tugas berikut:
+ Menginstal Apache dan PHP.
+ Mengkonfigurasi CloudWatch agen untuk meneruskan log akses Apache ke CloudWatch Log.
+ Menyiapkan peran IAM untuk memungkinkan CloudWatch agen mengirim data log ke CloudWatch Log.
+ Membuat alarm dan notifikasi khusus untuk memantau kesalahan 404 atau penggunaan bandwidth tinggi.
Peristiwa log dari server web menyediakan data metrik untuk CloudWatch alarm. Dua filter metrik menjelaskan bagaimana informasi log diubah menjadi CloudWatch metrik. Metrik 404 menghitung jumlah kejadian 404. Metrik ukuran melacak ukuran permintaan. Kedua CloudWatch alarm akan mengirimkan pemberitahuan jika ada lebih dari dua 404 dalam waktu 2 menit atau jika ukuran permintaan rata-rata lebih dari 3500 KB selama 10 menit.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Sample template that sets up and configures CloudWatch Logs on Amazon Linux 2023 instance.",
"Parameters": {
"KeyName": {
"Description": "Name of an existing EC2 KeyPair to enable SSH access to the instances",
"Type": "AWS::EC2::KeyPair::KeyName",
"ConstraintDescription": "must be the name of an existing EC2 KeyPair."
},
"SSHLocation": {
"Description": "The IP address range that can be used to SSH to the EC2 instances",
"Type": "String",
"MinLength": "9",
"MaxLength": "18",
"Default": "0.0.0.0/0",
"AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
"ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
},
"OperatorEmail": {
"Description": "Email address to notify when CloudWatch alarms are triggered (404 errors or high bandwidth usage)",
"Type": "String"
}
},
"Resources": {
"LogRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Path": "/",
"Policies": [
{
"PolicyName": "LogRolePolicy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:PutLogEvents",
"logs:DescribeLogStreams",
"logs:DescribeLogGroups",
"logs:CreateLogGroup",
"logs:CreateLogStream"
],
"Resource": "*"
}
]
}
}
]
}
},
"LogRoleInstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [{"Ref": "LogRole"}]
}
},
"WebServerSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Enable HTTP access via port 80 and SSH access via port 22",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": 22,
"ToPort": 22,
"CidrIp": {"Ref": "SSHLocation"}
}
]
}
},
"WebServerHost": {
"Type": "AWS::EC2::Instance",
"Metadata": {
"Comment": "Install a simple PHP application on Amazon Linux 2023",
"AWS::CloudFormation::Init": {
"config": {
"packages": {
"dnf": {
"httpd": [],
"php": [],
"php-fpm": []
}
},
"files": {
"/etc/amazon-cloudwatch-agent/amazon-cloudwatch-agent.json": {
"content": {
"logs": {
"logs_collected": {
"files": {
"collect_list": [{
"file_path": "/var/log/httpd/access_log",
"log_group_name": {"Ref": "WebServerLogGroup"},
"log_stream_name": "{instance_id}/apache.log",
"timestamp_format": "%d/%b/%Y:%H:%M:%S %z"
}]
}
}
}
},
"mode": "000644",
"owner": "root",
"group": "root"
},
"/var/www/html/index.php": {
"content": "AWS CloudFormation sample PHP application on Amazon Linux 2023';\n?>\n",
"mode": "000644",
"owner": "apache",
"group": "apache"
},
"/etc/cfn/cfn-hup.conf": {
"content": {
"Fn::Join": [
"",
[
"[main]\n",
"stack=",
{"Ref": "AWS::StackId"},
"\n",
"region=",
{"Ref": "AWS::Region"},
"\n"
]
]
},
"mode": "000400",
"owner": "root",
"group": "root"
},
"/etc/cfn/hooks.d/cfn-auto-reloader.conf": {
"content": {
"Fn::Join": [
"",
[
"[cfn-auto-reloader-hook]\n",
"triggers=post.update\n",
"path=Resources.WebServerHost.Metadata.AWS::CloudFormation::Init\n",
"action=/opt/aws/bin/cfn-init -s ",
{"Ref": "AWS::StackId"},
" -r WebServerHost ",
" --region ",
{"Ref": "AWS::Region"},
"\n",
"runas=root\n"
]
]
}
}
},
"services": {
"systemd": {
"httpd": {
"enabled": "true",
"ensureRunning": "true"
},
"php-fpm": {
"enabled": "true",
"ensureRunning": "true"
}
}
}
}
}
},
"CreationPolicy": {
"ResourceSignal": {
"Timeout": "PT5M"
}
},
"Properties": {
"ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}",
"KeyName": {"Ref": "KeyName"},
"InstanceType": "t3.micro",
"SecurityGroupIds": [{"Ref": "WebServerSecurityGroup"}],
"IamInstanceProfile": {"Ref": "LogRoleInstanceProfile"},
"UserData": {"Fn::Base64": {"Fn::Join": [ "", [
"#!/bin/bash\n",
"dnf update -y aws-cfn-bootstrap\n",
"dnf install -y amazon-cloudwatch-agent\n",
"/opt/aws/bin/cfn-init -v --stack ", {"Ref": "AWS::StackName"}, " --resource WebServerHost --region ", {"Ref": "AWS::Region"}, "\n",
"\n",
"# Verify Apache log directory exists and create if needed\n",
"mkdir -p /var/log/httpd\n",
"\n",
"# Start CloudWatch agent\n",
"/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/etc/amazon-cloudwatch-agent/amazon-cloudwatch-agent.json -s\n",
"\n",
"# Signal success\n",
"/opt/aws/bin/cfn-signal -e $? --stack ", {"Ref": "AWS::StackName"}, " --resource WebServerHost --region ", {"Ref": "AWS::Region"}, "\n"
]]}}
}
},
"WebServerLogGroup": {
"Type": "AWS::Logs::LogGroup",
"DeletionPolicy": "Retain",
"UpdateReplacePolicy": "Retain",
"Properties": {
"RetentionInDays": 7
}
},
"404MetricFilter": {
"Type": "AWS::Logs::MetricFilter",
"Properties": {
"LogGroupName": {"Ref": "WebServerLogGroup"},
"FilterPattern": "[ip, identity, user_id, timestamp, request, status_code = 404, size, ...]",
"MetricTransformations": [
{
"MetricValue": "1",
"MetricNamespace": "test/404s",
"MetricName": "test404Count"
}
]
}
},
"BytesTransferredMetricFilter": {
"Type": "AWS::Logs::MetricFilter",
"Properties": {
"LogGroupName": {"Ref": "WebServerLogGroup"},
"FilterPattern": "[ip, identity, user_id, timestamp, request, status_code, size, ...]",
"MetricTransformations": [
{
"MetricValue": "$size",
"MetricNamespace": "test/BytesTransferred",
"MetricName": "testBytesTransferred"
}
]
}
},
"404Alarm": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "The number of 404s is greater than 2 over 2 minutes",
"MetricName": "test404Count",
"Namespace": "test/404s",
"Statistic": "Sum",
"Period": "60",
"EvaluationPeriods": "2",
"Threshold": "2",
"AlarmActions": [{"Ref": "AlarmNotificationTopic"}],
"ComparisonOperator": "GreaterThanThreshold"
}
},
"BandwidthAlarm": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "The average volume of traffic is greater 3500 KB over 10 minutes",
"MetricName": "testBytesTransferred",
"Namespace": "test/BytesTransferred",
"Statistic": "Average",
"Period": "300",
"EvaluationPeriods": "2",
"Threshold": "3500",
"AlarmActions": [{"Ref": "AlarmNotificationTopic"}],
"ComparisonOperator": "GreaterThanThreshold"
}
},
"AlarmNotificationTopic": {
"Type": "AWS::SNS::Topic",
"Properties": {
"Subscription": [{"Endpoint": {"Ref": "OperatorEmail"}, "Protocol": "email"}]
}
}
},
"Outputs": {
"InstanceId": {
"Description": "The instance ID of the web server",
"Value": {"Ref": "WebServerHost"}
},
"WebsiteURL": {
"Value": {"Fn::Sub": "http://${WebServerHost.PublicDnsName}"},
"Description": "URL for the web server"
},
"PublicIP": {
"Description": "Public IP address of the web server",
"Value": {"Fn::GetAtt": ["WebServerHost","PublicIp"]
}
},
"CloudWatchLogGroupName": {
"Description": "The name of the CloudWatch log group",
"Value": {"Ref": "WebServerLogGroup"}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: 2010-09-09
Description: Sample template that sets up and configures CloudWatch Logs on Amazon Linux 2023 instance.
Parameters:
KeyName:
Description: Name of an existing EC2 KeyPair to enable SSH access to the instances
Type: AWS::EC2::KeyPair::KeyName
ConstraintDescription: must be the name of an existing EC2 KeyPair.
SSHLocation:
Description: The IP address range that can be used to SSH to the EC2 instances
Type: String
MinLength: '9'
MaxLength: '18'
Default: 0.0.0.0/0
AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
OperatorEmail:
Description: Email address to notify when CloudWatch alarms are triggered (404 errors or high bandwidth usage)
Type: String
Resources:
LogRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- 'sts:AssumeRole'
Path: /
Policies:
- PolicyName: LogRolePolicy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- 'logs:PutLogEvents'
- 'logs:DescribeLogStreams'
- 'logs:DescribeLogGroups'
- 'logs:CreateLogGroup'
- 'logs:CreateLogStream'
Resource: '*'
LogRoleInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: /
Roles:
- !Ref LogRole
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80 and SSH access via port 22
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: !Ref SSHLocation
WebServerHost:
Type: AWS::EC2::Instance
Metadata:
Comment: Install a simple PHP application on Amazon Linux 2023
'AWS::CloudFormation::Init':
config:
packages:
dnf:
httpd: []
php: []
php-fpm: []
files:
/etc/amazon-cloudwatch-agent/amazon-cloudwatch-agent.json:
content: !Sub |
{
"logs": {
"logs_collected": {
"files": {
"collect_list": [
{
"file_path": "/var/log/httpd/access_log",
"log_group_name": "${WebServerLogGroup}",
"log_stream_name": "{instance_id}/apache.log",
"timestamp_format": "%d/%b/%Y:%H:%M:%S %z"
}
]
}
}
}
}
mode: '000644'
owner: root
group: root
/var/www/html/index.php:
content: |
AWS CloudFormation sample PHP application on Amazon Linux 2023';
?>
mode: '000644'
owner: apache
group: apache
/etc/cfn/cfn-hup.conf:
content: !Sub |
[main]
stack=${AWS::StackId}
region=${AWS::Region}
mode: '000400'
owner: root
group: root
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
content: !Sub |
[cfn-auto-reloader-hook]
triggers=post.update
path=Resources.WebServerHost.Metadata.AWS::CloudFormation::Init
action=/opt/aws/bin/cfn-init -s ${AWS::StackId} -r WebServerHost --region ${AWS::Region}
runas=root
services:
systemd:
httpd:
enabled: 'true'
ensureRunning: 'true'
php-fpm:
enabled: 'true'
ensureRunning: 'true'
CreationPolicy:
ResourceSignal:
Timeout: PT5M
Properties:
ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}'
KeyName: !Ref KeyName
InstanceType: t3.micro
SecurityGroupIds:
- !Ref WebServerSecurityGroup
IamInstanceProfile: !Ref LogRoleInstanceProfile
UserData: !Base64
Fn::Sub: |
#!/bin/bash
dnf update -y aws-cfn-bootstrap
dnf install -y amazon-cloudwatch-agent
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}
# Verify Apache log directory exists and create if needed
mkdir -p /var/log/httpd
# Start CloudWatch agent
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a fetch-config -m ec2 -c file:/etc/amazon-cloudwatch-agent/amazon-cloudwatch-agent.json -s
# Signal success
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource WebServerHost --region ${AWS::Region}
echo "Done"
WebServerLogGroup:
Type: AWS::Logs::LogGroup
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
RetentionInDays: 7
404MetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
LogGroupName: !Ref WebServerLogGroup
FilterPattern: >-
[ip, identity, user_id, timestamp, request, status_code = 404, size, ...]
MetricTransformations:
- MetricValue: '1'
MetricNamespace: test/404s
MetricName: test404Count
BytesTransferredMetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
LogGroupName: !Ref WebServerLogGroup
FilterPattern: '[ip, identity, user_id, timestamp, request, status_code, size, ...]'
MetricTransformations:
- MetricValue: $size
MetricNamespace: test/BytesTransferred
MetricName: testBytesTransferred
404Alarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmDescription: The number of 404s is greater than 2 over 2 minutes
MetricName: test404Count
Namespace: test/404s
Statistic: Sum
Period: '60'
EvaluationPeriods: '2'
Threshold: '2'
AlarmActions:
- !Ref AlarmNotificationTopic
ComparisonOperator: GreaterThanThreshold
BandwidthAlarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmDescription: The average volume of traffic is greater 3500 KB over 10 minutes
MetricName: testBytesTransferred
Namespace: test/BytesTransferred
Statistic: Average
Period: '300'
EvaluationPeriods: '2'
Threshold: '3500'
AlarmActions:
- !Ref AlarmNotificationTopic
ComparisonOperator: GreaterThanThreshold
AlarmNotificationTopic:
Type: AWS::SNS::Topic
Properties:
Subscription:
- Endpoint: !Ref OperatorEmail
Protocol: email
Outputs:
InstanceId:
Description: The instance ID of the web server
Value: !Ref WebServerHost
WebsiteURL:
Value: !Sub 'http://${WebServerHost.PublicDnsName}'
Description: URL for the web server
PublicIP:
Description: Public IP address of the web server
Value: !GetAtt WebServerHost.PublicIp
CloudWatchLogGroupName:
Description: The name of the CloudWatch log group
Value: !Ref WebServerLogGroup
```
## Kirim CloudWatch log ke Log dari instance Windows
Template berikut mengkonfigurasi CloudWatch Log untuk instance Windows 2012R2.
Agen CloudWatch Log di Windows (agen SSM di Windows 2012R2 dan Windows 2016 AMIs) hanya mengirim log setelah dimulai, jadi log apa pun yang dihasilkan sebelum startup tidak dikirim. Untuk mengatasi ini, templat membantu untuk memastikan agar agen dimulai sebelum log ditulis oleh:
+ Pengonfigurasian penyiapan agen sebagai item `config` yang pertama dalam `configSets` cfn-init.
+ Penggunaan `waitAfterCompletion` untuk menyisipkan jeda setelah perintah yang memulai agen.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Sample template that sets up and configures CloudWatch Logs on Windows 2012R2 instance.",
"Parameters": {
"KeyPair": {
"Description": "Name of an existing EC2 KeyPair to enable RDP access to the instances",
"Type": "AWS::EC2::KeyPair::KeyName",
"ConstraintDescription": "must be the name of an existing EC2 KeyPair."
},
"RDPLocation": {
"Description": "The IP address range that can be used to RDP to the EC2 instances",
"Type": "String",
"MinLength": "9",
"MaxLength": "18",
"Default": "0.0.0.0/0",
"AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
"ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
},
"OperatorEmail": {
"Description": "Email address to notify when CloudWatch alarms are triggered (404 errors)",
"Type": "String"
}
},
"Resources": {
"WebServerSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Enable HTTP access via port 80 and RDP access via port 3389",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": "80",
"ToPort": "80",
"CidrIp": "0.0.0.0/0"
},
{
"IpProtocol": "tcp",
"FromPort": "3389",
"ToPort": "3389",
"CidrIp": {"Ref": "RDPLocation"}
}
]
}
},
"LogRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
],
"Path": "/",
"Policies": [
{
"PolicyName": "LogRolePolicy",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:Create*",
"logs:PutLogEvents",
"s3:GetObject"
],
"Resource": [
"arn:aws:logs:*:*:*",
"arn:aws:s3:::*"
]
}
]
}
}
]
}
},
"LogRoleInstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [{"Ref": "LogRole"}]
}
},
"WebServerHost": {
"Type": "AWS::EC2::Instance",
"CreationPolicy": {
"ResourceSignal": {
"Timeout": "PT15M"
}
},
"Metadata": {
"AWS::CloudFormation::Init": {
"configSets": {
"config": [
"00-ConfigureCWLogs",
"01-InstallWebServer",
"02-ConfigureApplication",
"03-Finalize"
]
},
"00-ConfigureCWLogs": {
"files": {
"C:\\Program Files\\Amazon\\SSM\\Plugins\\awsCloudWatch\\AWS.EC2.Windows.CloudWatch.json": {
"content": {
"EngineConfiguration": {
"Components": [
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "ApplicationEventLog",
"Parameters": {
"Levels": "7",
"LogName": "Application"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "SystemEventLog",
"Parameters": {
"Levels": "7",
"LogName": "System"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "SecurityEventLog",
"Parameters": {
"Levels": "7",
"LogName": "Security"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "EC2ConfigLog",
"Parameters": {
"CultureName": "en-US",
"Encoding": "ASCII",
"Filter": "EC2ConfigLog.txt",
"LogDirectoryPath": "C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs",
"TimeZoneKind": "UTC",
"TimestampFormat": "yyyy-MM-ddTHH:mm:ss.fffZ:"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "CfnInitLog",
"Parameters": {
"CultureName": "en-US",
"Encoding": "ASCII",
"Filter": "cfn-init.log",
"LogDirectoryPath": "C:\\cfn\\log",
"TimeZoneKind": "Local",
"TimestampFormat": "yyyy-MM-dd HH:mm:ss,fff"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "IISLogs",
"Parameters": {
"CultureName": "en-US",
"Encoding": "UTF-8",
"Filter": "",
"LineCount": "3",
"LogDirectoryPath": "C:\\inetpub\\logs\\LogFiles\\W3SVC1",
"TimeZoneKind": "UTC",
"TimestampFormat": "yyyy-MM-dd HH:mm:ss"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.PerformanceCounterComponent.PerformanceCounterInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "MemoryPerformanceCounter",
"Parameters": {
"CategoryName": "Memory",
"CounterName": "Available MBytes",
"DimensionName": "",
"DimensionValue": "",
"InstanceName": "",
"MetricName": "Memory",
"Unit": "Megabytes"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchApplicationEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/ApplicationEventLog",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchSystemEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/SystemEventLog",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchSecurityEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/SecurityEventLog",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchEC2ConfigLog",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/EC2ConfigLog",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchCfnInitLog",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/CfnInitLog",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchIISLogs",
"Parameters": {
"AccessKey": "",
"LogGroup": {"Ref": "LogGroup"},
"LogStream": "{instance_id}/IISLogs",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatch.CloudWatchOutputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatch",
"Parameters": {
"AccessKey": "",
"NameSpace": "Windows/Default",
"Region": {"Ref": "AWS::Region"},
"SecretKey": ""
}
}
],
"Flows": {
"Flows": [
"ApplicationEventLog,CloudWatchApplicationEventLog",
"SystemEventLog,CloudWatchSystemEventLog",
"SecurityEventLog,CloudWatchSecurityEventLog",
"EC2ConfigLog,CloudWatchEC2ConfigLog",
"CfnInitLog,CloudWatchCfnInitLog",
"IISLogs,CloudWatchIISLogs",
"MemoryPerformanceCounter,CloudWatch"
]
},
"PollInterval": "00:00:05"
},
"IsEnabled": true
}
}
},
"commands": {
"0-enableSSM": {
"command": "powershell.exe -Command \"Set-Service -Name AmazonSSMAgent -StartupType Automatic\" ",
"waitAfterCompletion": "0"
},
"1-restartSSM": {
"command": "powershell.exe -Command \"Restart-Service AmazonSSMAgent \"",
"waitAfterCompletion": "30"
}
}
},
"01-InstallWebServer": {
"commands": {
"01_install_webserver": {
"command": "powershell.exe -Command \"Install-WindowsFeature Web-Server -IncludeAllSubFeature\"",
"waitAfterCompletion": "0"
}
}
},
"02-ConfigureApplication": {
"files": {
"c:\\Inetpub\\wwwroot\\index.htm": {
"content": " Test Application Page Congratulations!! Your IIS server is configured.
"
}
}
},
"03-Finalize": {
"commands": {
"00_signal_success": {
"command": {
"Fn::Sub": "cfn-signal.exe -e 0 --resource WebServerHost --stack ${AWS::StackName} --region ${AWS::Region}"
},
"waitAfterCompletion": "0"
}
}
}
}
},
"Properties": {
"KeyName": {
"Ref": "KeyPair"
},
"ImageId": "{{resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2012-R2_RTM-English-64Bit-Base}}",
"InstanceType": "t2.xlarge",
"SecurityGroupIds": [{"Ref": "WebServerSecurityGroup"}],
"IamInstanceProfile": {"Ref": "LogRoleInstanceProfile"},
"UserData": {
"Fn::Base64": {
"Fn::Join": [
"",
[
"\n"
]
]
}
}
}
},
"LogGroup": {
"Type": "AWS::Logs::LogGroup",
"Properties": {
"RetentionInDays": 7
}
},
"404MetricFilter": {
"Type": "AWS::Logs::MetricFilter",
"Properties": {
"LogGroupName": {"Ref": "LogGroup"},
"FilterPattern": "[timestamps, serverip, method, uri, query, port, dash, clientip, useragent, status_code = 404, ...]",
"MetricTransformations": [
{
"MetricValue": "1",
"MetricNamespace": "test/404s",
"MetricName": "test404Count"
}
]
}
},
"404Alarm": {
"Type": "AWS::CloudWatch::Alarm",
"Properties": {
"AlarmDescription": "The number of 404s is greater than 2 over 2 minutes",
"MetricName": "test404Count",
"Namespace": "test/404s",
"Statistic": "Sum",
"Period": "60",
"EvaluationPeriods": "2",
"Threshold": "2",
"AlarmActions": [{"Ref": "AlarmNotificationTopic"}],
"ComparisonOperator": "GreaterThanThreshold"
}
},
"AlarmNotificationTopic": {
"Type": "AWS::SNS::Topic",
"Properties": {
"Subscription": [{"Endpoint": {"Ref": "OperatorEmail"}, "Protocol": "email"}]
}
}
},
"Outputs": {
"InstanceId": {
"Description": "The instance ID of the web server",
"Value": {"Ref": "WebServerHost"}
},
"WebsiteURL": {
"Value": {"Fn::Sub": "http://${WebServerHost.PublicDnsName}"},
"Description": "URL for the web server"
},
"PublicIP": {
"Description": "Public IP address of the web server",
"Value": {"Fn::GetAtt": ["WebServerHost","PublicIp"]}
},
"CloudWatchLogGroupName": {
"Description": "The name of the CloudWatch log group",
"Value": {"Ref": "LogGroup"}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: 2010-09-09
Description: >-
Sample template that sets up and configures CloudWatch Logs on Windows 2012R2 instance.
Parameters:
KeyPair:
Description: Name of an existing EC2 KeyPair to enable RDP access to the instances
Type: AWS::EC2::KeyPair::KeyName
ConstraintDescription: must be the name of an existing EC2 KeyPair.
RDPLocation:
Description: The IP address range that can be used to RDP to the EC2 instances
Type: String
MinLength: '9'
MaxLength: '18'
Default: 0.0.0.0/0
AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})'
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
OperatorEmail:
Description: Email address to notify when CloudWatch alarms are triggered (404 errors)
Type: String
Resources:
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80 and RDP access via port 3389
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: '80'
ToPort: '80'
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: '3389'
ToPort: '3389'
CidrIp: !Ref RDPLocation
LogRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- 'sts:AssumeRole'
ManagedPolicyArns:
- 'arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore'
Path: /
Policies:
- PolicyName: LogRolePolicy
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Action:
- 'logs:Create*'
- 'logs:PutLogEvents'
- 's3:GetObject'
Resource:
- 'arn:aws:logs:*:*:*'
- 'arn:aws:s3:::*'
LogRoleInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: /
Roles:
- !Ref LogRole
WebServerHost:
Type: AWS::EC2::Instance
CreationPolicy:
ResourceSignal:
Timeout: PT15M
Metadata:
'AWS::CloudFormation::Init':
configSets:
config:
- 00-ConfigureCWLogs
- 01-InstallWebServer
- 02-ConfigureApplication
- 03-Finalize
00-ConfigureCWLogs:
files:
'C:\Program Files\Amazon\SSM\Plugins\awsCloudWatch\AWS.EC2.Windows.CloudWatch.json':
content: !Sub |
{
"EngineConfiguration": {
"Components": [
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "ApplicationEventLog",
"Parameters": {
"Levels": "7",
"LogName": "Application"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "SystemEventLog",
"Parameters": {
"Levels": "7",
"LogName": "System"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.EventLog.EventLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "SecurityEventLog",
"Parameters": {
"Levels": "7",
"LogName": "Security"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "EC2ConfigLog",
"Parameters": {
"CultureName": "en-US",
"Encoding": "ASCII",
"Filter": "EC2ConfigLog.txt",
"LogDirectoryPath": "C:\\Program Files\\Amazon\\Ec2ConfigService\\Logs",
"TimeZoneKind": "UTC",
"TimestampFormat": "yyyy-MM-ddTHH:mm:ss.fffZ:"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "CfnInitLog",
"Parameters": {
"CultureName": "en-US",
"Encoding": "ASCII",
"Filter": "cfn-init.log",
"LogDirectoryPath": "C:\\cfn\\log",
"TimeZoneKind": "Local",
"TimestampFormat": "yyyy-MM-dd HH:mm:ss,fff"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CustomLog.CustomLogInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "IISLogs",
"Parameters": {
"CultureName": "en-US",
"Encoding": "UTF-8",
"Filter": "",
"LineCount": "3",
"LogDirectoryPath": "C:\\inetpub\\logs\\LogFiles\\W3SVC1",
"TimeZoneKind": "UTC",
"TimestampFormat": "yyyy-MM-dd HH:mm:ss"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.PerformanceCounterComponent.PerformanceCounterInputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "MemoryPerformanceCounter",
"Parameters": {
"CategoryName": "Memory",
"CounterName": "Available MBytes",
"DimensionName": "",
"DimensionValue": "",
"InstanceName": "",
"MetricName": "Memory",
"Unit": "Megabytes"
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchApplicationEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/ApplicationEventLog",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchSystemEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/SystemEventLog",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchSecurityEventLog",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/SecurityEventLog",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchEC2ConfigLog",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/EC2ConfigLog",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchCfnInitLog",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/CfnInitLog",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatchLogsOutput,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatchIISLogs",
"Parameters": {
"AccessKey": "",
"LogGroup": "${LogGroup}",
"LogStream": "{instance_id}/IISLogs",
"Region": "${AWS::Region}",
"SecretKey": ""
}
},
{
"FullName": "AWS.EC2.Windows.CloudWatch.CloudWatch.CloudWatchOutputComponent,AWS.EC2.Windows.CloudWatch",
"Id": "CloudWatch",
"Parameters": {
"AccessKey": "",
"NameSpace": "Windows/Default",
"Region": "${AWS::Region}",
"SecretKey": ""
}
}
],
"Flows": {
"Flows": [
"ApplicationEventLog,CloudWatchApplicationEventLog",
"SystemEventLog,CloudWatchSystemEventLog",
"SecurityEventLog,CloudWatchSecurityEventLog",
"EC2ConfigLog,CloudWatchEC2ConfigLog",
"CfnInitLog,CloudWatchCfnInitLog",
"IISLogs,CloudWatchIISLogs",
"MemoryPerformanceCounter,CloudWatch"
]
},
"PollInterval": "00:00:05"
},
"IsEnabled": true
}
commands:
0-enableSSM:
command: >-
powershell.exe -Command "Set-Service -Name AmazonSSMAgent
-StartupType Automatic"
waitAfterCompletion: '0'
1-restartSSM:
command: powershell.exe -Command "Restart-Service AmazonSSMAgent "
waitAfterCompletion: '30'
01-InstallWebServer:
commands:
01_install_webserver:
command: >-
powershell.exe -Command "Install-WindowsFeature Web-Server
-IncludeAllSubFeature"
waitAfterCompletion: '0'
02-ConfigureApplication:
files:
'c:\Inetpub\wwwroot\index.htm':
content: >-
Test Application Page
Congratulations !! Your IIS server is
configured.
03-Finalize:
commands:
00_signal_success:
command: !Sub >-
cfn-signal.exe -e 0 --resource WebServerHost --stack
${AWS::StackName} --region ${AWS::Region}
waitAfterCompletion: '0'
Properties:
KeyName: !Ref KeyPair
ImageId: "{{resolve:ssm:/aws/service/ami-windows-latest/Windows_Server-2012-R2_RTM-English-64Bit-Base}}"
InstanceType: t2.xlarge
SecurityGroupIds:
- !Ref WebServerSecurityGroup
IamInstanceProfile: !Ref LogRoleInstanceProfile
UserData: !Base64
'Fn::Sub': >
LogGroup:
Type: AWS::Logs::LogGroup
Properties:
RetentionInDays: 7
404MetricFilter:
Type: AWS::Logs::MetricFilter
Properties:
LogGroupName: !Ref LogGroup
FilterPattern: >-
[timestamps, serverip, method, uri, query, port, dash, clientip,
useragent, status_code = 404, ...]
MetricTransformations:
- MetricValue: '1'
MetricNamespace: test/404s
MetricName: test404Count
404Alarm:
Type: AWS::CloudWatch::Alarm
Properties:
AlarmDescription: The number of 404s is greater than 2 over 2 minutes
MetricName: test404Count
Namespace: test/404s
Statistic: Sum
Period: '60'
EvaluationPeriods: '2'
Threshold: '2'
AlarmActions:
- !Ref AlarmNotificationTopic
ComparisonOperator: GreaterThanThreshold
AlarmNotificationTopic:
Type: AWS::SNS::Topic
Properties:
Subscription:
- Endpoint: !Ref OperatorEmail
Protocol: email
Outputs:
InstanceId:
Description: The instance ID of the web server
Value: !Ref WebServerHost
WebsiteURL:
Value: !Sub 'http://${WebServerHost.PublicDnsName}'
Description: URL for the web server
PublicIP:
Description: Public IP address of the web server
Value: !GetAtt
- WebServerHost
- PublicIp
CloudWatchLogGroupName:
Description: The name of the CloudWatch log group
Value: !Ref LogGroup
```
## Lihat juga
Untuk informasi selengkapnya tentang sumber daya CloudWatch Log, lihat [AWS::Logs::LogGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-logs-loggroup.html)atau [AWS::Logs::MetricFilter](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-logs-metricfilter.html).
# Cuplikan template Amazon DynamoDB
**Topics**
+ [Application Auto Scaling dengan tabel Amazon DynamoDB](#quickref-dynamodb-application-autoscaling)
+ [Lihat juga](#w2aac11c41c39b7)
## Application Auto Scaling dengan tabel Amazon DynamoDB
Contoh ini menetapkan Application Auto Scaling untuk sumber daya `AWS::DynamoDB::Table`. Templat tersebut menentukan kebijakan penskalaan `TargetTrackingScaling` yang menaikkan skala throughput `WriteCapacityUnits` untuk tabel.
### JSON
```
{
"Resources": {
"DDBTable": {
"Type": "AWS::DynamoDB::Table",
"Properties": {
"AttributeDefinitions": [
{
"AttributeName": "ArtistId",
"AttributeType": "S"
},
{
"AttributeName": "Concert",
"AttributeType": "S"
},
{
"AttributeName": "TicketSales",
"AttributeType": "S"
}
],
"KeySchema": [
{
"AttributeName": "ArtistId",
"KeyType": "HASH"
},
{
"AttributeName": "Concert",
"KeyType": "RANGE"
}
],
"GlobalSecondaryIndexes": [
{
"IndexName": "GSI",
"KeySchema": [
{
"AttributeName": "TicketSales",
"KeyType": "HASH"
}
],
"Projection": {
"ProjectionType": "KEYS_ONLY"
},
"ProvisionedThroughput": {
"ReadCapacityUnits": 5,
"WriteCapacityUnits": 5
}
}
],
"ProvisionedThroughput": {
"ReadCapacityUnits": 5,
"WriteCapacityUnits": 5
}
}
},
"WriteCapacityScalableTarget": {
"Type": "AWS::ApplicationAutoScaling::ScalableTarget",
"Properties": {
"MaxCapacity": 15,
"MinCapacity": 5,
"ResourceId": {
"Fn::Join": [
"/",
[
"table",
{
"Ref": "DDBTable"
}
]
]
},
"RoleARN" : { "Fn::Sub" : "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable" },
"ScalableDimension": "dynamodb:table:WriteCapacityUnits",
"ServiceNamespace": "dynamodb"
}
},
"WriteScalingPolicy": {
"Type": "AWS::ApplicationAutoScaling::ScalingPolicy",
"Properties": {
"PolicyName": "WriteAutoScalingPolicy",
"PolicyType": "TargetTrackingScaling",
"ScalingTargetId": {
"Ref": "WriteCapacityScalableTarget"
},
"TargetTrackingScalingPolicyConfiguration": {
"TargetValue": 50,
"ScaleInCooldown": 60,
"ScaleOutCooldown": 60,
"PredefinedMetricSpecification": {
"PredefinedMetricType": "DynamoDBWriteCapacityUtilization"
}
}
}
}
}
}
```
### YAML
```
Resources:
DDBTable:
Type: AWS::DynamoDB::Table
Properties:
AttributeDefinitions:
- AttributeName: "ArtistId"
AttributeType: "S"
- AttributeName: "Concert"
AttributeType: "S"
- AttributeName: "TicketSales"
AttributeType: "S"
KeySchema:
- AttributeName: "ArtistId"
KeyType: "HASH"
- AttributeName: "Concert"
KeyType: "RANGE"
GlobalSecondaryIndexes:
- IndexName: "GSI"
KeySchema:
- AttributeName: "TicketSales"
KeyType: "HASH"
Projection:
ProjectionType: "KEYS_ONLY"
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
ProvisionedThroughput:
ReadCapacityUnits: 5
WriteCapacityUnits: 5
WriteCapacityScalableTarget:
Type: AWS::ApplicationAutoScaling::ScalableTarget
Properties:
MaxCapacity: 15
MinCapacity: 5
ResourceId: !Join
- /
- - table
- !Ref DDBTable
RoleARN:
Fn::Sub: 'arn:aws:iam::${AWS::AccountId}:role/aws-service-role/dynamodb.application-autoscaling.amazonaws.com/AWSServiceRoleForApplicationAutoScaling_DynamoDBTable'
ScalableDimension: dynamodb:table:WriteCapacityUnits
ServiceNamespace: dynamodb
WriteScalingPolicy:
Type: AWS::ApplicationAutoScaling::ScalingPolicy
Properties:
PolicyName: WriteAutoScalingPolicy
PolicyType: TargetTrackingScaling
ScalingTargetId: !Ref WriteCapacityScalableTarget
TargetTrackingScalingPolicyConfiguration:
TargetValue: 50.0
ScaleInCooldown: 60
ScaleOutCooldown: 60
PredefinedMetricSpecification:
PredefinedMetricType: DynamoDBWriteCapacityUtilization
```
## Lihat juga
Untuk informasi selengkapnya, lihat posting blog [Cara menggunakan CloudFormation untuk mengonfigurasi penskalaan otomatis untuk tabel dan indeks DynamoDB](https://aws.amazon.com/blogs/database/how-to-use-aws-cloudformation-to-configure-auto-scaling-for-amazon-dynamodb-tables-and-indexes/) di Blog Database. AWS
Untuk informasi selengkapnya tentang sumber daya DynamoDB, lihat. [AWS::DynamoDB::Table](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-table.html)
# Cuplikan EC2 CloudFormation template Amazon
Amazon EC2 menyediakan kapasitas komputasi yang dapat diskalakan di. AWS Cloud Anda dapat menggunakan Amazon EC2 untuk meluncurkan server virtual sebanyak atau sesedikit yang Anda butuhkan, mengonfigurasi keamanan dan jaringan, dan mengelola penyimpanan. Server virtual ini, yang dikenal sebagai instance, dapat menjalankan berbagai sistem operasi dan aplikasi, dan dapat disesuaikan untuk memenuhi kebutuhan spesifik Anda. Amazon EC2 memungkinkan Anda meningkatkan atau menurunkan skala untuk menangani perubahan persyaratan atau lonjakan penggunaan.
Anda dapat menentukan dan menyediakan EC2 instans Amazon sebagai bagian dari infrastruktur Anda menggunakan CloudFormation templat. Template memudahkan pengelolaan dan otomatisasi penyebaran EC2 sumber daya Amazon secara berulang dan konsisten.
Contoh cuplikan template berikut menjelaskan CloudFormation sumber daya atau komponen untuk Amazon. EC2 Cuplikan ini dirancang untuk diintegrasikan ke dalam template dan tidak dimaksudkan untuk dijalankan secara independen.
**Topics**
+ [Mengkonfigurasi Instans EC2](quickref-ec2-instance-config.md)
+ [Buat template peluncuran](quickref-ec2-launch-templates.md)
+ [Mengelola grup keamanan](quickref-ec2-sg.md)
+ [Alokasikan Elastis IPs](quickref-ec2-elastic-ip.md)
+ [Konfigurasikan sumber daya VPC](quickref-ec2-vpc.md)
# Konfigurasikan instans Amazon EC2 dengan CloudFormation
Cuplikan berikut menunjukkan cara mengonfigurasi instans Amazon EC2 menggunakan. CloudFormation
**Topics**
+ [Konfigurasi umum Amazon EC2](#quickref-ec2-instance-config-general)
+ [Tentukan pemetaan perangkat blok untuk sebuah instance](#scenario-ec2-bdm)
## Konfigurasi umum Amazon EC2
Cuplikan berikut menunjukkan konfigurasi umum untuk instans Amazon EC2 yang digunakan. CloudFormation
**Topics**
+ [Membuat instans Amazon EC2 di Availability Zone yang ditentukan](#scenario-ec2-instance)
+ [Mengonfigurasi instans Amazon EC2 yang diberi tag dengan volume EBS dan data pengguna](#scenario-ec2-instance-with-vol-and-tags)
+ [Tentukan nama tabel DynamoDB dalam data pengguna untuk peluncuran instans Amazon EC2](#scenario-ec2-with-sdb-domain)
+ [Buat volume Amazon EBS dengan `DeletionPolicy`](#scenario-ec2-volume)
### Membuat instans Amazon EC2 di Availability Zone yang ditentukan
Cuplikan berikut membuat instance Amazon EC2 di Availability Zone yang ditentukan menggunakan resource. [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) Kode untuk Availability Zone adalah kode Region diikuti oleh pengidentifikasi huruf. Anda dapat meluncurkan instance ke dalam Availability Zone tunggal.
#### JSON
```
1. "Ec2Instance": {
2. "Type": "AWS::EC2::Instance",
3. "Properties": {
4. "AvailabilityZone": "aa-example-1a",
5. "ImageId": "ami-1234567890abcdef0"
6. }
7. }
```
#### YAML
```
1. Ec2Instance:
2. Type: AWS::EC2::Instance
3. Properties:
4. AvailabilityZone: aa-example-1a
5. ImageId: ami-1234567890abcdef0
```
### Mengonfigurasi instans Amazon EC2 yang diberi tag dengan volume EBS dan data pengguna
Cuplikan berikut membuat instans Amazon EC2 dengan tag, volume EBS, dan data pengguna. Ini menggunakan sumber [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html)daya. Dalam template yang sama, Anda harus menentukan [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya, [AWS::SNS::Topic](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html)sumber daya, dan [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)sumber daya. `KeyName`Harus didefinisikan di `Parameters` bagian template.
Tag dapat membantu Anda mengkategorikan AWS sumber daya berdasarkan preferensi Anda, seperti berdasarkan tujuan, pemilik, atau lingkungan. Data pengguna memungkinkan penyediaan skrip atau data khusus ke instance selama peluncuran. Data ini memfasilitasi otomatisasi tugas, konfigurasi perangkat lunak, instalasi paket, dan tindakan lain pada instance selama inisialisasi.
Untuk informasi selengkapnya tentang menandai sumber daya Anda, lihat [Menandai sumber daya Amazon EC2 Anda](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html) di Panduan Pengguna *Amazon EC2*.
Untuk informasi tentang data pengguna, lihat [Menggunakan metadata instans untuk mengelola instans EC2 Anda](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) di Panduan Pengguna *Amazon* EC2.
#### JSON
```
1. "Ec2Instance": {
2. "Type": "AWS::EC2::Instance",
3. "Properties": {
4. "KeyName": { "Ref": "KeyName" },
5. "SecurityGroups": [ { "Ref": "Ec2SecurityGroup" } ],
6. "UserData": {
7. "Fn::Base64": {
8. "Fn::Join": [ ":", [
9. "PORT=80",
10. "TOPIC=",
11. { "Ref": "MySNSTopic" }
12. ]
13. ]
14. }
15. },
16. "InstanceType": "aa.size",
17. "AvailabilityZone": "aa-example-1a",
18. "ImageId": "ami-1234567890abcdef0",
19. "Volumes": [
20. {
21. "VolumeId": { "Ref": "MyVolumeResource" },
22. "Device": "/dev/sdk"
23. }
24. ],
25. "Tags": [ { "Key": "Name", "Value": "MyTag" } ]
26. }
27. }
```
#### YAML
```
1. Ec2Instance:
2. Type: AWS::EC2::Instance
3. Properties:
4. KeyName: !Ref KeyName
5. SecurityGroups:
6. - !Ref Ec2SecurityGroup
7. UserData:
8. Fn::Base64:
9. Fn::Join:
10. - ":"
11. - - "PORT=80"
12. - "TOPIC="
13. - !Ref MySNSTopic
14. InstanceType: aa.size
15. AvailabilityZone: aa-example-1a
16. ImageId: ami-1234567890abcdef0
17. Volumes:
18. - VolumeId: !Ref MyVolumeResource
19. Device: "/dev/sdk"
20. Tags:
21. - Key: Name
22. Value: MyTag
```
### Tentukan nama tabel DynamoDB dalam data pengguna untuk peluncuran instans Amazon EC2
Cuplikan berikut membuat instance Amazon EC2 dan mendefinisikan nama tabel DynamoDB dalam data pengguna untuk diteruskan ke instance saat peluncuran. Ini menggunakan sumber [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html)daya. Anda dapat menentukan parameter atau nilai dinamis dalam data pengguna untuk meneruskan instans EC2 saat peluncuran.
Untuk informasi selengkapnya tentang data pengguna, lihat [Menggunakan metadata instans untuk mengelola instans EC2 Anda](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) di Panduan Pengguna *Amazon* EC2.
#### JSON
```
1. "Ec2Instance": {
2. "Type": "AWS::EC2::Instance",
3. "Properties": {
4. "UserData": {
5. "Fn::Base64": {
6. "Fn::Join": [
7. "",
8. [
9. "TableName=",
10. {
11. "Ref": "DynamoDBTableName"
12. }
13. ]
14. ]
15. }
16. },
17. "AvailabilityZone": "aa-example-1a",
18. "ImageId": "ami-1234567890abcdef0"
19. }
20. }
```
#### YAML
```
1. Ec2Instance:
2. Type: AWS::EC2::Instance
3. Properties:
4. UserData:
5. Fn::Base64:
6. Fn::Join:
7. - ''
8. - - 'TableName='
9. - Ref: DynamoDBTableName
10. AvailabilityZone: aa-example-1a
11. ImageId: ami-1234567890abcdef0
```
### Buat volume Amazon EBS dengan `DeletionPolicy`
Cuplikan berikut membuat volume Amazon EBS menggunakan sumber daya Amazon EC2. [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html) Anda dapat menggunakan `SnapshotID` properti `Size` or untuk menentukan volume, tetapi tidak keduanya. `DeletionPolicy`Atribut diatur untuk membuat snapshot volume saat tumpukan dihapus.
Untuk informasi selengkapnya tentang `DeletionPolicy` atribut, lihat [DeletionPolicyatribut](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-deletionpolicy.html).
Untuk informasi selengkapnya tentang membuat volume Amazon EBS, lihat [Membuat volume Amazon EBS](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-creating-volume.html).
#### JSON
**Cuplikan ini membuat volume Amazon EBS dengan ukuran tertentu.** Ukurannya diatur ke 10, tetapi Anda dapat menyesuaikannya sesuai kebutuhan. [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)Sumber daya memungkinkan Anda untuk menentukan ukuran atau ID snapshot tetapi tidak keduanya.
```
1. "MyEBSVolume": {
2. "Type": "AWS::EC2::Volume",
3. "Properties": {
4. "Size": "10",
5. "AvailabilityZone": {
6. "Ref": "AvailabilityZone"
7. }
8. },
9. "DeletionPolicy": "Snapshot"
10. }
```
**Cuplikan ini membuat volume Amazon EBS menggunakan ID snapshot yang disediakan.** [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)Sumber daya memungkinkan Anda untuk menentukan ukuran atau ID snapshot tetapi tidak keduanya.
```
1. "MyEBSVolume": {
2. "Type": "AWS::EC2::Volume",
3. "Properties": {
4. "SnapshotId" : "snap-1234567890abcdef0",
5. "AvailabilityZone": {
6. "Ref": "AvailabilityZone"
7. }
8. },
9. "DeletionPolicy": "Snapshot"
10. }
```
#### YAML
**Cuplikan ini membuat volume Amazon EBS dengan ukuran tertentu.** Ukurannya diatur ke 10, tetapi Anda dapat menyesuaikannya sesuai kebutuhan. [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)Sumber daya memungkinkan Anda untuk menentukan ukuran atau ID snapshot tetapi tidak keduanya.
```
1. MyEBSVolume:
2. Type: AWS::EC2::Volume
3. Properties:
4. Size: 10
5. AvailabilityZone:
6. Ref: AvailabilityZone
7. DeletionPolicy: Snapshot
```
**Cuplikan ini membuat volume Amazon EBS menggunakan ID snapshot yang disediakan.** [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)Sumber daya memungkinkan Anda untuk menentukan ukuran atau ID snapshot tetapi tidak keduanya.
```
1. MyEBSVolume:
2. Type: AWS::EC2::Volume
3. Properties:
4. SnapshotId: snap-1234567890abcdef0
5. AvailabilityZone:
6. Ref: AvailabilityZone
7. DeletionPolicy: Snapshot
```
## Tentukan pemetaan perangkat blok untuk sebuah instance
Pemetaan perangkat blok mendefinisikan perangkat blok, yang mencakup volume penyimpanan instans dan volume EBS, untuk dilampirkan ke sebuah instance. Anda dapat menentukan pemetaan perangkat blok saat membuat AMI sehingga pemetaan digunakan oleh semua instance yang diluncurkan dari AMI. Atau, Anda dapat menentukan pemetaan perangkat blok saat meluncurkan instance, sehingga pemetaan menggantikan yang ditentukan dalam AMI tempat instance diluncurkan.
Anda dapat menggunakan cuplikan templat berikut untuk menentukan pemetaan perangkat blok untuk volume penyimpanan EBS atau instans menggunakan properti sumber daya. `BlockDeviceMappings` [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html)
*Untuk informasi selengkapnya tentang memblokir pemetaan perangkat, lihat [Memblokir pemetaan perangkat untuk volume pada instans Amazon EC2 di Panduan Pengguna Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/block-device-mapping-concepts.html).*
**Topics**
+ [Tentukan pemetaan perangkat blok untuk dua volume EBS](#w2aac11c41c43c13b9c11)
+ [Tentukan pemetaan perangkat blok untuk volume penyimpanan instance](#w2aac11c41c43c13b9c13)
### Tentukan pemetaan perangkat blok untuk dua volume EBS
#### JSON
```
"Ec2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
"KeyName": { "Ref": "KeyName" },
"InstanceType": { "Ref": "InstanceType" },
"SecurityGroups": [{ "Ref": "Ec2SecurityGroup" }],
"BlockDeviceMappings": [
{
"DeviceName": "/dev/sda1",
"Ebs": { "VolumeSize": "50" }
},
{
"DeviceName": "/dev/sdm",
"Ebs": { "VolumeSize": "100" }
}
]
}
}
}
```
#### YAML
```
EC2Instance:
Type: AWS::EC2::Instance
Properties:
ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
KeyName: !Ref KeyName
InstanceType: !Ref InstanceType
SecurityGroups:
- !Ref Ec2SecurityGroup
BlockDeviceMappings:
-
DeviceName: /dev/sda1
Ebs:
VolumeSize: 50
-
DeviceName: /dev/sdm
Ebs:
VolumeSize: 100
```
### Tentukan pemetaan perangkat blok untuk volume penyimpanan instance
#### JSON
```
"Ec2Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"ImageId" : "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
"KeyName" : { "Ref" : "KeyName" },
"InstanceType": { "Ref": "InstanceType" },
"SecurityGroups" : [{ "Ref" : "Ec2SecurityGroup" }],
"BlockDeviceMappings" : [
{
"DeviceName" : "/dev/sdc",
"VirtualName" : "ephemeral0"
}
]
}
}
```
#### YAML
```
EC2Instance:
Type: AWS::EC2::Instance
Properties:
ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
KeyName: !Ref KeyName
InstanceType: !Ref InstanceType
SecurityGroups:
- !Ref Ec2SecurityGroup
BlockDeviceMappings:
- DeviceName: /dev/sdc
VirtualName: ephemeral0
```
# Buat template peluncuran dengan CloudFormation
Bagian ini memberikan contoh untuk membuat template peluncuran Amazon EC2 menggunakan. CloudFormation Template peluncuran memungkinkan Anda membuat templat untuk mengonfigurasi dan menyediakan instans Amazon EC2 di dalamnya. AWS Dengan template peluncuran, Anda dapat menyimpan parameter peluncuran sehingga Anda tidak perlu menentukannya setiap kali Anda meluncurkan instance. Untuk contoh lainnya, lihat bagian [Contoh](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html#aws-resource-ec2-launchtemplate--examples) di `AWS::EC2::LaunchTemplate` sumber daya.
Untuk informasi selengkapnya tentang template peluncuran, lihat [Menyimpan parameter peluncuran instans di templat peluncuran Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-launch-templates.html) di Panduan Pengguna *Amazon EC2*.
Untuk informasi tentang membuat templat peluncuran untuk digunakan dengan grup Auto Scaling, lihat templat [peluncuran Auto Scaling](https://docs.aws.amazon.com/autoscaling/ec2/userguide/launch-templates.html) di Panduan Pengguna *Amazon EC2 Auto Scaling*.
**Topics**
+ [Buat template peluncuran yang menentukan grup keamanan, tag, data pengguna, dan peran IAM](#scenario-as-launch-template)
## Buat template peluncuran yang menentukan grup keamanan, tag, data pengguna, dan peran IAM
Cuplikan ini menunjukkan [AWS::EC2::LaunchTemplate](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html)sumber daya yang berisi informasi konfigurasi untuk meluncurkan instance. Anda menentukan nilai untuk`ImageId`,`InstanceType`,`SecurityGroups`,`UserData`, dan `TagSpecifications` properti. `SecurityGroups`Properti menentukan grup keamanan EC2 yang ada dan grup keamanan baru. `Ref`Fungsi mendapatkan ID dari [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya `myNewEC2SecurityGroup` yang dideklarasikan di tempat lain di template tumpukan.
Template peluncuran mencakup bagian untuk data pengguna kustom. Anda dapat meneruskan tugas konfigurasi dan skrip yang berjalan saat instance diluncurkan di bagian ini. Dalam contoh ini, data pengguna menginstal AWS Systems Manager Agen dan memulai agen.
Template peluncuran juga menyertakan peran IAM yang memungkinkan aplikasi yang berjalan pada instance untuk melakukan tindakan atas nama Anda. Contoh ini menunjukkan [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html)sumber daya untuk template peluncuran, yang menggunakan `IamInstanceProfile` properti untuk menentukan peran IAM. `Ref`Fungsi mendapatkan nama sumber [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-instanceprofile.html)daya`myInstanceProfile`. Untuk mengonfigurasi izin peran IAM, Anda menentukan nilai untuk properti. `ManagedPolicyArns`
### JSON
```
1. {
2. "Resources":{
3. "myLaunchTemplate":{
4. "Type":"AWS::EC2::LaunchTemplate",
5. "Properties":{
6. "LaunchTemplateName":{ "Fn::Sub": "${AWS::StackName}-launch-template" },
7. "LaunchTemplateData":{
8. "ImageId":"ami-02354e95b3example",
9. "InstanceType":"t3.micro",
10. "IamInstanceProfile":{
11. "Name":{
12. "Ref":"myInstanceProfile"
13. }
14. },
15. "SecurityGroupIds":[
16. {
17. "Ref":"myNewEC2SecurityGroup"
18. },
19. "sg-083cd3bfb8example"
20. ],
21. "UserData":{
22. "Fn::Base64":{
23. "Fn::Join": [
24. "", [
25. "#!/bin/bash\n",
26. "cd /tmp\n",
27. "yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm\n",
28. "systemctl enable amazon-ssm-agent\n",
29. "systemctl start amazon-ssm-agent\n"
30. ]
31. ]
32. }
33. },
34. "TagSpecifications":[
35. {
36. "ResourceType":"instance",
37. "Tags":[
38. {
39. "Key":"environment",
40. "Value":"development"
41. }
42. ]
43. },
44. {
45. "ResourceType":"volume",
46. "Tags":[
47. {
48. "Key":"environment",
49. "Value":"development"
50. }
51. ]
52. }
53. ]
54. }
55. }
56. },
57. "myInstanceRole":{
58. "Type":"AWS::IAM::Role",
59. "Properties":{
60. "RoleName":"InstanceRole",
61. "AssumeRolePolicyDocument":{
62. "Version": "2012-10-17",
63. "Statement":[
64. {
65. "Effect":"Allow",
66. "Principal":{
67. "Service":[
68. "ec2.amazonaws.com"
69. ]
70. },
71. "Action":[
72. "sts:AssumeRole"
73. ]
74. }
75. ]
76. },
77. "ManagedPolicyArns":[
78. "arn:aws:iam::aws:policy/myCustomerManagedPolicy"
79. ]
80. }
81. },
82. "myInstanceProfile":{
83. "Type":"AWS::IAM::InstanceProfile",
84. "Properties":{
85. "Path":"/",
86. "Roles":[
87. {
88. "Ref":"myInstanceRole"
89. }
90. ]
91. }
92. }
93. }
94. }
```
### YAML
```
1. ---
2. Resources:
3. myLaunchTemplate:
4. Type: AWS::EC2::LaunchTemplate
5. Properties:
6. LaunchTemplateName: !Sub ${AWS::StackName}-launch-template
7. LaunchTemplateData:
8. ImageId: ami-02354e95b3example
9. InstanceType: t3.micro
10. IamInstanceProfile:
11. Name: !Ref myInstanceProfile
12. SecurityGroupIds:
13. - !Ref myNewEC2SecurityGroup
14. - sg-083cd3bfb8example
15. UserData:
16. Fn::Base64: !Sub |
17. #!/bin/bash
18. cd /tmp
19. yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
20. systemctl enable amazon-ssm-agent
21. systemctl start amazon-ssm-agent
22. TagSpecifications:
23. - ResourceType: instance
24. Tags:
25. - Key: environment
26. Value: development
27. - ResourceType: volume
28. Tags:
29. - Key: environment
30. Value: development
31. myInstanceRole:
32. Type: AWS::IAM::Role
33. Properties:
34. RoleName: InstanceRole
35. AssumeRolePolicyDocument:
36. Version: '2012-10-17'
37. Statement:
38. - Effect: 'Allow'
39. Principal:
40. Service:
41. - 'ec2.amazonaws.com'
42. Action:
43. - 'sts:AssumeRole'
44. ManagedPolicyArns:
45. - 'arn:aws:iam::aws:policy/myCustomerManagedPolicy'
46. myInstanceProfile:
47. Type: AWS::IAM::InstanceProfile
48. Properties:
49. Path: '/'
50. Roles:
51. - !Ref myInstanceRole
```
# Kelola grup keamanan dengan CloudFormation
Cuplikan berikut menunjukkan cara menggunakan CloudFormation untuk mengelola grup keamanan dan instans Amazon EC2 untuk mengontrol akses ke sumber daya Anda. AWS
**Topics**
+ [Kaitkan instans Amazon EC2 dengan grup keamanan](#quickref-ec2-instances-associate-security-group)
+ [Buat grup keamanan dengan aturan masuk](#quickref-ec2-instances-ingress)
+ [Buat Elastic Load Balancer dengan aturan masuknya grup keamanan](#scenario-ec2-security-group-elbingress)
## Kaitkan instans Amazon EC2 dengan grup keamanan
Contoh cuplikan berikut menunjukkan cara mengaitkan instans Amazon EC2 dengan grup keamanan Amazon VPC default yang digunakan. CloudFormation
**Topics**
+ [Kaitkan instans Amazon EC2 dengan grup keamanan VPC default](#using-cfn-getatt-default-values)
+ [Membuat instans Amazon EC2 dengan volume dan grup keamanan terlampir](#scenario-ec2-volumeattachment)
### Kaitkan instans Amazon EC2 dengan grup keamanan VPC default
Cuplikan berikut membuat Amazon VPC, subnet dalam VPC, dan instans Amazon EC2. VPC dibuat menggunakan sumber daya [AWS: :EC2: :VPC](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpc.html). Rentang alamat IP untuk VPC didefinisikan dalam template yang lebih besar dan direferensikan oleh parameter. `MyVPCCIDRRange`
Subnet dibuat dalam VPC menggunakan sumber daya [AWS: :EC2::](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-subnet.html) Subnet. Subnet dikaitkan dengan VPC, yang direferensikan sebagai. `MyVPC`
Instans EC2 diluncurkan dalam VPC dan subnet menggunakan sumber daya. [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) Resource ini menentukan Amazon Machine Image (AMI) yang akan digunakan untuk meluncurkan instance, subnet tempat instance akan berjalan, dan grup keamanan yang akan diasosiasikan dengan instance. `ImageId`Menggunakan parameter Systems Manager untuk secara dinamis mengambil Amazon Linux 2 AMI terbaru.
ID grup keamanan diperoleh dengan menggunakan `Fn::GetAtt` fungsi, yang mengambil grup keamanan default dari `MyVPC` sumber daya.
Instance ditempatkan dalam `MySubnet` sumber daya yang ditentukan dalam cuplikan.
Saat Anda membuat VPC menggunakan CloudFormation, AWS secara otomatis membuat sumber daya default dalam VPC, termasuk grup keamanan default. Namun, ketika Anda mendefinisikan VPC dalam CloudFormation template, Anda mungkin tidak memiliki akses ke sumber daya default ini saat Anda membuat template. IDs Untuk mengakses dan menggunakan sumber daya default yang ditentukan dalam template, Anda dapat menggunakan fungsi intrinsik seperti. `Fn::GetAtt` Fungsi ini memungkinkan Anda untuk bekerja dengan sumber daya default yang dibuat secara otomatis oleh CloudFormation.
#### JSON
```
"MyVPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": {
"Ref": "MyVPCCIDRRange"
},
"EnableDnsSupport": false,
"EnableDnsHostnames": false,
"InstanceTenancy": "default"
}
},
"MySubnet": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"CidrBlock": {
"Ref": "MyVPCCIDRRange"
},
"VpcId": {
"Ref": "MyVPC"
}
}
},
"MyInstance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
"SecurityGroupIds": [
{
"Fn::GetAtt": [
"MyVPC",
"DefaultSecurityGroup"
]
}
],
"SubnetId": {
"Ref": "MySubnet"
}
}
}
```
#### YAML
```
MyVPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock:
Ref: MyVPCCIDRRange
EnableDnsSupport: false
EnableDnsHostnames: false
InstanceTenancy: default
MySubnet:
Type: AWS::EC2::Subnet
Properties:
CidrBlock:
Ref: MyVPCCIDRRange
VpcId:
Ref: MyVPC
MyInstance:
Type: AWS::EC2::Instance
Properties:
ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
SecurityGroupIds:
- Fn::GetAtt:
- MyVPC
- DefaultSecurityGroup
SubnetId:
Ref: MySubnet
```
### Membuat instans Amazon EC2 dengan volume dan grup keamanan terlampir
Cuplikan berikut membuat instans Amazon EC2 menggunakan sumber daya, [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html)yang diluncurkan dari AMI yang ditunjuk. Instance ini dikaitkan dengan grup keamanan yang memungkinkan lalu lintas SSH masuk pada port 22 dari alamat IP tertentu, menggunakan sumber daya. [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html) Ini menciptakan volume Amazon EBS 100 GB menggunakan [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.html)sumber daya. Volume dibuat di zona ketersediaan yang sama dengan instance, seperti yang ditentukan oleh `GetAtt` fungsi, dan dipasang ke instance di `/dev/sdh` perangkat.
Untuk informasi selengkapnya tentang membuat volume Amazon EBS, lihat [Membuat volume Amazon EBS](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-creating-volume.html).
#### JSON
```
1. "Ec2Instance": {
2. "Type": "AWS::EC2::Instance",
3. "Properties": {
4. "SecurityGroups": [
5. {
6. "Ref": "InstanceSecurityGroup"
7. }
8. ],
9. "ImageId": "ami-1234567890abcdef0"
10. }
11. },
12. "InstanceSecurityGroup": {
13. "Type": "AWS::EC2::SecurityGroup",
14. "Properties": {
15. "GroupDescription": "Enable SSH access via port 22",
16. "SecurityGroupIngress": [
17. {
18. "IpProtocol": "tcp",
19. "FromPort": "22",
20. "ToPort": "22",
21. "CidrIp": "192.0.2.0/24"
22. }
23. ]
24. }
25. },
26. "NewVolume": {
27. "Type": "AWS::EC2::Volume",
28. "Properties": {
29. "Size": "100",
30. "AvailabilityZone": {
31. "Fn::GetAtt": [
32. "Ec2Instance",
33. "AvailabilityZone"
34. ]
35. }
36. }
37. },
38. "MountPoint": {
39. "Type": "AWS::EC2::VolumeAttachment",
40. "Properties": {
41. "InstanceId": {
42. "Ref": "Ec2Instance"
43. },
44. "VolumeId": {
45. "Ref": "NewVolume"
46. },
47. "Device": "/dev/sdh"
48. }
49. }
```
#### YAML
```
1. Ec2Instance:
2. Type: AWS::EC2::Instance
3. Properties:
4. SecurityGroups:
5. - !Ref InstanceSecurityGroup
6. ImageId: ami-1234567890abcdef0
7. InstanceSecurityGroup:
8. Type: AWS::EC2::SecurityGroup
9. Properties:
10. GroupDescription: Enable SSH access via port 22
11. SecurityGroupIngress:
12. - IpProtocol: tcp
13. FromPort: 22
14. ToPort: 22
15. CidrIp: 192.0.2.0/24
16. NewVolume:
17. Type: AWS::EC2::Volume
18. Properties:
19. Size: 100
20. AvailabilityZone: !GetAtt [Ec2Instance, AvailabilityZone]
21. MountPoint:
22. Type: AWS::EC2::VolumeAttachment
23. Properties:
24. InstanceId: !Ref Ec2Instance
25. VolumeId: !Ref NewVolume
26. Device: /dev/sdh
```
## Buat grup keamanan dengan aturan masuk
Contoh cuplikan berikut menunjukkan cara mengkonfigurasi grup keamanan dengan aturan masuk tertentu menggunakan. CloudFormation
**Topics**
+ [Buat grup keamanan dengan aturan masuk untuk akses SSH dan HTTP](#scenario-ec2-security-group-rule)
+ [Buat grup keamanan dengan aturan ingress untuk akses HTTP dan SSH dari rentang CIDR yang ditentukan](#scenario-ec2-security-group-two-ports)
+ [Buat grup keamanan referensi silang dengan aturan masuk](#scenario-ec2-security-group-ingress)
### Buat grup keamanan dengan aturan masuk untuk akses SSH dan HTTP
Cuplikan berikut menjelaskan dua aturan masuknya grup keamanan menggunakan sumber daya. [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html) Aturan masuk pertama memungkinkan akses SSH (port 22) dari grup keamanan yang ada bernama`MyAdminSecurityGroup`, yang dimiliki oleh AWS akun dengan nomor akun. `1111-2222-3333` Aturan ingress kedua memungkinkan akses HTTP (port 80) dari grup keamanan yang berbeda bernama`MySecurityGroupCreatedInCFN`, yang dibuat dalam template yang sama. `Ref`Fungsi ini digunakan untuk referensi nama logis dari grup keamanan yang dibuat dalam template yang sama.
Dalam aturan ingress pertama, Anda harus menambahkan nilai untuk `SourceSecurityGroupOwnerId` properti `SourceSecurityGroupName` dan properti. Dalam aturan ingress kedua, `MySecurityGroupCreatedInCFNTemplate` referensi grup keamanan yang berbeda, yang dibuat dalam template yang sama. Verifikasi bahwa nama logis `MySecurityGroupCreatedInCFNTemplate` cocok dengan nama logis sebenarnya dari sumber daya grup keamanan yang Anda tentukan dalam templat yang lebih besar.
Untuk informasi selengkapnya tentang grup keamanan, lihat [grup keamanan Amazon EC2 untuk instans Amazon EC2 Anda](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) di Panduan Pengguna Amazon *EC2*.
#### JSON
```
1. "SecurityGroup": {
2. "Type": "AWS::EC2::SecurityGroup",
3. "Properties": {
4. "GroupDescription": "Allow connections from specified source security group",
5. "SecurityGroupIngress": [
6. {
7. "IpProtocol": "tcp",
8. "FromPort": "22",
9. "ToPort": "22",
10. "SourceSecurityGroupName": "MyAdminSecurityGroup",
11. "SourceSecurityGroupOwnerId": "1111-2222-3333"
12. },
13. {
14. "IpProtocol": "tcp",
15. "FromPort": "80",
16. "ToPort": "80",
17. "SourceSecurityGroupName": {
18. "Ref": "MySecurityGroupCreatedInCFNTemplate"
19. }
20. }
21. ]
22. }
23. }
```
#### YAML
```
1. SecurityGroup:
2. Type: AWS::EC2::SecurityGroup
3. Properties:
4. GroupDescription: Allow connections from specified source security group
5. SecurityGroupIngress:
6. - IpProtocol: tcp
7. FromPort: '22'
8. ToPort: '22'
9. SourceSecurityGroupName: MyAdminSecurityGroup
10. SourceSecurityGroupOwnerId: '1111-2222-3333'
11. - IpProtocol: tcp
12. FromPort: '80'
13. ToPort: '80'
14. SourceSecurityGroupName:
15. Ref: MySecurityGroupCreatedInCFNTemplate
```
### Buat grup keamanan dengan aturan ingress untuk akses HTTP dan SSH dari rentang CIDR yang ditentukan
Cuplikan berikut membuat grup keamanan untuk instans Amazon EC2 dengan dua aturan masuk. Aturan masuk memungkinkan lalu lintas TCP masuk pada port yang ditentukan dari rentang CIDR yang ditentukan. [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)Sumber daya digunakan untuk menentukan aturan. Anda harus menentukan protokol untuk setiap aturan. Untuk TCP, Anda harus menentukan port atau rentang port. Jika Anda tidak menentukan grup keamanan sumber atau rentang CIDR, tumpukan akan berhasil diluncurkan, tetapi aturan tidak akan diterapkan ke grup keamanan.
Untuk informasi selengkapnya tentang grup keamanan, lihat [grup keamanan Amazon EC2 untuk instans Amazon EC2 Anda](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html) di Panduan Pengguna Amazon *EC2*.
#### JSON
```
1. "ServerSecurityGroup": {
2. "Type": "AWS::EC2::SecurityGroup",
3. "Properties": {
4. "GroupDescription": "Allow connections from specified CIDR ranges",
5. "SecurityGroupIngress": [
6. {
7. "IpProtocol": "tcp",
8. "FromPort": "80",
9. "ToPort": "80",
10. "CidrIp": "192.0.2.0/24"
11. },
12. {
13. "IpProtocol": "tcp",
14. "FromPort": "22",
15. "ToPort": "22",
16. "CidrIp": "192.0.2.0/24"
17. }
18. ]
19. }
20. }
```
#### YAML
```
1. ServerSecurityGroup:
2. Type: AWS::EC2::SecurityGroup
3. Properties:
4. GroupDescription: Allow connections from specified CIDR ranges
5. SecurityGroupIngress:
6. - IpProtocol: tcp
7. FromPort: 80
8. ToPort: 80
9. CidrIp: 192.0.2.0/24
10. - IpProtocol: tcp
11. FromPort: 22
12. ToPort: 22
13. CidrIp: 192.0.2.0/24
```
### Buat grup keamanan referensi silang dengan aturan masuk
Cuplikan berikut menggunakan [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya untuk membuat dua grup keamanan Amazon EC2, dan. `SGroup1` `SGroup2` Aturan masuk yang memungkinkan komunikasi antara dua kelompok keamanan dibuat dengan menggunakan sumber daya [AWS::EC2::SecurityGroupIngress](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroupingress.html). `SGroup1Ingress`menetapkan aturan ingress untuk `SGroup1` yang memungkinkan lalu lintas TCP masuk pada port 80 dari grup keamanan sumber,. `SGroup2` `SGroup2Ingress`menetapkan aturan ingress untuk `SGroup2` yang memungkinkan lalu lintas TCP masuk pada port 80 dari grup keamanan sumber,. `SGroup1`
#### JSON
```
1. "SGroup1": {
2. "Type": "AWS::EC2::SecurityGroup",
3. "Properties": {
4. "GroupDescription": "EC2 instance access"
5. }
6. },
7. "SGroup2": {
8. "Type": "AWS::EC2::SecurityGroup",
9. "Properties": {
10. "GroupDescription": "EC2 instance access"
11. }
12. },
13. "SGroup1Ingress": {
14. "Type": "AWS::EC2::SecurityGroupIngress",
15. "Properties": {
16. "GroupName": {
17. "Ref": "SGroup1"
18. },
19. "IpProtocol": "tcp",
20. "ToPort": "80",
21. "FromPort": "80",
22. "SourceSecurityGroupName": {
23. "Ref": "SGroup2"
24. }
25. }
26. },
27. "SGroup2Ingress": {
28. "Type": "AWS::EC2::SecurityGroupIngress",
29. "Properties": {
30. "GroupName": {
31. "Ref": "SGroup2"
32. },
33. "IpProtocol": "tcp",
34. "ToPort": "80",
35. "FromPort": "80",
36. "SourceSecurityGroupName": {
37. "Ref": "SGroup1"
38. }
39. }
40. }
```
#### YAML
```
1. SGroup1:
2. Type: AWS::EC2::SecurityGroup
3. Properties:
4. GroupDescription: EC2 Instance access
5. SGroup2:
6. Type: AWS::EC2::SecurityGroup
7. Properties:
8. GroupDescription: EC2 Instance access
9. SGroup1Ingress:
10. Type: AWS::EC2::SecurityGroupIngress
11. Properties:
12. GroupName: !Ref SGroup1
13. IpProtocol: tcp
14. ToPort: 80
15. FromPort: 80
16. SourceSecurityGroupName: !Ref SGroup2
17. SGroup2Ingress:
18. Type: AWS::EC2::SecurityGroupIngress
19. Properties:
20. GroupName: !Ref SGroup2
21. IpProtocol: tcp
22. ToPort: 80
23. FromPort: 80
24. SourceSecurityGroupName: !Ref SGroup1
```
## Buat Elastic Load Balancer dengan aturan masuknya grup keamanan
Template berikut membuat [AWS::ElasticLoadBalancing::LoadBalancer](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancing-loadbalancer.html)sumber daya di zona ketersediaan yang ditentukan. [AWS::ElasticLoadBalancing::LoadBalancer](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-elasticloadbalancing-loadbalancer.html)Sumber daya dikonfigurasi untuk mendengarkan pada port 80 untuk lalu lintas HTTP dan permintaan langsung ke instance juga pada port 80. Elastic Load Balancer bertanggung jawab untuk menyeimbangkan beban lalu lintas HTTP yang masuk di antara instans.
Selain itu, template ini menghasilkan [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html)sumber daya yang terkait dengan penyeimbang beban. Grup keamanan ini dibuat dengan aturan masuk tunggal, digambarkan sebagai`ELB ingress group`, yang memungkinkan lalu lintas TCP masuk pada port 80. Sumber untuk aturan ingress ini didefinisikan menggunakan `Fn::GetAtt` fucntion untuk mengambil atribut dari sumber daya penyeimbang beban. `SourceSecurityGroupOwnerId`digunakan `Fn::GetAtt` untuk mendapatkan kelompok keamanan sumber dari penyeimbang beban. `OwnerAlias` `SourceSecurityGroupName`digunakan `Fn::Getatt` untuk mendapatkan kelompok keamanan sumber ELB. `GroupName`
Pengaturan ini memastikan komunikasi yang aman antara ELB dan instans.
Untuk informasi selengkapnya tentang load balancing, lihat Panduan Pengguna [Elastic Load Balancing](https://docs.aws.amazon.com/elasticloadbalancing/latest/userguide/).
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"MyELB": {
"Type": "AWS::ElasticLoadBalancing::LoadBalancer",
"Properties": {
"AvailabilityZones": [
"aa-example-1a"
],
"Listeners": [
{
"LoadBalancerPort": "80",
"InstancePort": "80",
"Protocol": "HTTP"
}
]
}
},
"MyELBIngressGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "ELB ingress group",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"SourceSecurityGroupOwnerId": {
"Fn::GetAtt": [
"MyELB",
"SourceSecurityGroup.OwnerAlias"
]
},
"SourceSecurityGroupName": {
"Fn::GetAtt": [
"MyELB",
"SourceSecurityGroup.GroupName"
]
}
}
]
}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
MyELB:
Type: AWS::ElasticLoadBalancing::LoadBalancer
Properties:
AvailabilityZones:
- aa-example-1a
Listeners:
- LoadBalancerPort: '80'
InstancePort: '80'
Protocol: HTTP
MyELBIngressGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: ELB ingress group
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: '80'
ToPort: '80'
SourceSecurityGroupOwnerId:
Fn::GetAtt:
- MyELB
- SourceSecurityGroup.OwnerAlias
SourceSecurityGroupName:
Fn::GetAtt:
- MyELB
- SourceSecurityGroup.GroupName
```
# Alokasikan dan kaitkan alamat IP Elastis dengan CloudFormation
Cuplikan template berikut adalah contoh yang terkait dengan alamat IP Elastis (EIP) di Amazon EC2. Contoh-contoh ini mencakup alokasi, asosiasi, dan manajemen EIPs untuk instans Anda.
**Topics**
+ [Alokasikan alamat IP Elastis dan kaitkan dengan instans Amazon EC2](#scenario-ec2-eip)
+ [Kaitkan alamat IP Elastis ke instans Amazon EC2 dengan menentukan alamat IP](#scenario-ec2-eip-association)
+ [Kaitkan alamat IP Elastis ke instans Amazon EC2 dengan menentukan ID alokasi alamat IP](#scenario-ec2-eip-association-vpc)
## Alokasikan alamat IP Elastis dan kaitkan dengan instans Amazon EC2
Cuplikan berikut mengalokasikan alamat Amazon EC2 Elastic IP (EIP) dan mengaitkannya dengan instans Amazon EC2 menggunakan sumber daya. [AWS::EC2::EIP ](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eip.html) Anda dapat mengalokasikan alamat EIP dari kumpulan alamat yang dimiliki oleh AWS atau dari kumpulan alamat yang dibuat dari rentang IPv4 alamat publik yang Anda bawa AWS untuk digunakan dengan AWS sumber daya Anda menggunakan [bawa alamat IP Anda sendiri (BYOIP)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html). Dalam contoh ini, EIP dialokasikan dari kumpulan alamat yang dimiliki oleh. AWS
Untuk informasi selengkapnya tentang alamat IP [Elastis, lihat Alamat IP](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html) Elastis di *Panduan Pengguna Amazon EC2*.
### JSON
```
1. "ElasticIP": {
2. "Type": "AWS::EC2::EIP",
3. "Properties": {
4. "InstanceId": {
5. "Ref": "Ec2Instance"
6. }
7. }
8. }
```
### YAML
```
1. ElasticIP:
2. Type: AWS::EC2::EIP
3. Properties:
4. InstanceId: !Ref EC2Instance
```
## Kaitkan alamat IP Elastis ke instans Amazon EC2 dengan menentukan alamat IP
Cuplikan berikut mengaitkan alamat IP Elastic Amazon EC2 yang ada ke instans EC2 menggunakan sumber daya [AWS](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html): :EC2::. EIPAssociation Anda harus terlebih dahulu mengalokasikan alamat IP Elastis untuk digunakan di akun Anda. Alamat IP elastis dapat dikaitkan dengan satu contoh.
### JSON
```
1. "IPAssoc": {
2. "Type": "AWS::EC2::EIPAssociation",
3. "Properties": {
4. "InstanceId": {
5. "Ref": "Ec2Instance"
6. },
7. "EIP": "192.0.2.0"
8. }
9. }
```
### YAML
```
1. IPAssoc:
2. Type: AWS::EC2::EIPAssociation
3. Properties:
4. InstanceId: !Ref EC2Instance
5. EIP: 192.0.2.0
```
## Kaitkan alamat IP Elastis ke instans Amazon EC2 dengan menentukan ID alokasi alamat IP
[Cuplikan berikut mengaitkan alamat IP Elastic yang ada ke instans Amazon EC2 dengan menentukan ID alokasi menggunakan sumber daya AWS: :EC2::. EIPAssociation](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html) ID alokasi ditetapkan ke alamat IP Elastis pada alokasi alamat IP Elastis.
### JSON
```
1. "IPAssoc": {
2. "Type": "AWS::EC2::EIPAssociation",
3. "Properties": {
4. "InstanceId": {
5. "Ref": "Ec2Instance"
6. },
7. "AllocationId": "eipalloc-1234567890abcdef0"
8. }
9. }
```
### YAML
```
1. IPAssoc:
2. Type: AWS::EC2::EIPAssociation
3. Properties:
4. InstanceId: !Ref EC2Instance
5. AllocationId: eipalloc-1234567890abcdef0
```
# Konfigurasikan sumber daya Amazon VPC dengan CloudFormation
Bagian ini memberikan contoh untuk mengonfigurasi sumber daya Amazon VPC menggunakan. CloudFormation VPCsmemungkinkan Anda membuat jaringan virtual di dalamnya AWS, dan cuplikan ini menunjukkan cara mengonfigurasi aspek VPCs untuk memenuhi persyaratan jaringan Anda.
**Topics**
+ [Aktifkan akses internet IPv6 khusus egres di VPC](#quickref-ec2-route-egressonlyinternetgateway)
+ [Potongan templat antarmuka jaringan elastis (ENI)](#cfn-template-snippets-eni)
## Aktifkan akses internet IPv6 khusus egres di VPC
Sebuah gateway internet egress-only memungkinkan instance dalam VPC untuk mengakses internet dan mencegah sumber daya di internet berkomunikasi dengan instans. Cuplikan berikut memungkinkan akses internet IPv6 khusus egres dari dalam VPC. Ini membuat VPC dengan rentang IPv4 alamat `10.0.0/16` menggunakan sumber daya [AWS: :EC2: :VPC](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpc.html). Tabel rute dikaitkan dengan sumber daya VPC ini menggunakan sumber daya. [AWS::EC2::RouteTable](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-routetable.html) Tabel rute mengelola rute untuk instance dalam VPC. An [AWS::EC2::EgressOnlyInternetGateway](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-egressonlyinternetgateway.html)digunakan untuk membuat gateway internet egress-only untuk memungkinkan IPv6 komunikasi untuk lalu lintas keluar dari instance dalam VPC, sekaligus mencegah lalu lintas masuk. [AWS::EC2::Route](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html)Sumber daya ditentukan untuk membuat IPv6 rute dalam tabel rute yang mengarahkan semua IPv6 lalu lintas keluar (`::/0`) ke gateway internet khusus egres.
*Untuk informasi selengkapnya tentang gateway internet khusus egres, lihat [Mengaktifkan IPv6 lalu lintas keluar menggunakan gateway internet khusus egres di Panduan](https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html) Pengguna Amazon VPC.*
### JSON
```
"DefaultIpv6Route": {
"Type": "AWS::EC2::Route",
"Properties": {
"DestinationIpv6CidrBlock": "::/0",
"EgressOnlyInternetGatewayId": {
"Ref": "EgressOnlyInternetGateway"
},
"RouteTableId": {
"Ref": "RouteTable"
}
}
},
"EgressOnlyInternetGateway": {
"Type": "AWS::EC2::EgressOnlyInternetGateway",
"Properties": {
"VpcId": {
"Ref": "VPC"
}
}
},
"RouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPC"
}
}
},
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.0.0.0/16"
}
}
```
### YAML
```
DefaultIpv6Route:
Type: AWS::EC2::Route
Properties:
DestinationIpv6CidrBlock: "::/0"
EgressOnlyInternetGatewayId:
Ref: "EgressOnlyInternetGateway"
RouteTableId:
Ref: "RouteTable"
EgressOnlyInternetGateway:
Type: AWS::EC2::EgressOnlyInternetGateway
Properties:
VpcId:
Ref: "VPC"
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: "VPC"
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: "10.0.0.0/16"
```
## Potongan templat antarmuka jaringan elastis (ENI)
### Buat instans Amazon EC2 dengan antarmuka jaringan elastis terlampir () ENIs
Contoh cuplikan berikut membuat instance Amazon EC2 menggunakan sumber daya di VPC Amazon dan subnet [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html)yang ditentukan. Ini melampirkan dua antarmuka jaringan (ENIs) dengan instance, mengaitkan alamat IP Elastic ke instance melalui terlampir ENIs, dan mengkonfigurasi grup keamanan untuk akses SSH dan HTTP. Data pengguna diberikan ke instance sebagai bagian dari konfigurasi peluncuran saat instance dibuat. Data pengguna menyertakan skrip yang dikodekan dalam `base64` format untuk memastikannya diteruskan ke instance. Ketika instance diluncurkan, skrip berjalan secara otomatis sebagai bagian dari proses bootstrap. Ini menginstal`ec2-net-utils`, mengkonfigurasi antarmuka jaringan, dan memulai layanan HTTP.
Untuk menentukan Amazon Machine Image (AMI) yang sesuai berdasarkan Wilayah yang dipilih, cuplikan menggunakan `Fn::FindInMap` fungsi yang mencari nilai dalam `RegionMap` pemetaan. Pemetaan ini harus didefinisikan dalam template yang lebih besar. Kedua antarmuka jaringan dibuat menggunakan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-networkinterface.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-networkinterface.html)sumber daya. Alamat IP elastis ditentukan menggunakan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eip.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eip.html)sumber daya yang dialokasikan ke `vpc` domain. Alamat IP elastis ini dikaitkan dengan antarmuka jaringan menggunakan [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html)sumber daya.
`Outputs`Bagian ini mendefinisikan nilai atau sumber daya yang ingin Anda akses setelah tumpukan dibuat. Dalam cuplikan ini, output yang ditentukan adalah`InstancePublicIp`, yang mewakili alamat IP publik dari instans EC2 yang dibuat oleh tumpukan. Anda dapat mengambil output ini di tab **Output** di CloudFormation konsol, atau menggunakan [perintah deskripsi-tumpukan](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stacks.html).
Untuk informasi selengkapnya tentang antarmuka jaringan elastis, lihat [Antarmuka jaringan elastis](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html).
#### JSON
```
"Resources": {
"ControlPortAddress": {
"Type": "AWS::EC2::EIP",
"Properties": {
"Domain": "vpc"
}
},
"AssociateControlPort": {
"Type": "AWS::EC2::EIPAssociation",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"ControlPortAddress",
"AllocationId"
]
},
"NetworkInterfaceId": {
"Ref": "controlXface"
}
}
},
"WebPortAddress": {
"Type": "AWS::EC2::EIP",
"Properties": {
"Domain": "vpc"
}
},
"AssociateWebPort": {
"Type": "AWS::EC2::EIPAssociation",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"WebPortAddress",
"AllocationId"
]
},
"NetworkInterfaceId": {
"Ref": "webXface"
}
}
},
"SSHSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "VpcId"
},
"GroupDescription": "Enable SSH access via port 22",
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
}
]
}
},
"WebSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "VpcId"
},
"GroupDescription": "Enable HTTP access via user-defined port",
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"FromPort": 80,
"IpProtocol": "tcp",
"ToPort": 80
}
]
}
},
"controlXface": {
"Type": "AWS::EC2::NetworkInterface",
"Properties": {
"SubnetId": {
"Ref": "SubnetId"
},
"Description": "Interface for controlling traffic such as SSH",
"GroupSet": [
{
"Fn::GetAtt": [
"SSHSecurityGroup",
"GroupId"
]
}
],
"SourceDestCheck": true,
"Tags": [
{
"Key": "Network",
"Value": "Control"
}
]
}
},
"webXface": {
"Type": "AWS::EC2::NetworkInterface",
"Properties": {
"SubnetId": {
"Ref": "SubnetId"
},
"Description": "Interface for web traffic",
"GroupSet": [
{
"Fn::GetAtt": [
"WebSecurityGroup",
"GroupId"
]
}
],
"SourceDestCheck": true,
"Tags": [
{
"Key": "Network",
"Value": "Web"
}
]
}
},
"Ec2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": {
"Fn::FindInMap": [
"RegionMap",
{
"Ref": "AWS::Region"
},
"AMI"
]
},
"KeyName": {
"Ref": "KeyName"
},
"NetworkInterfaces": [
{
"NetworkInterfaceId": {
"Ref": "controlXface"
},
"DeviceIndex": "0"
},
{
"NetworkInterfaceId": {
"Ref": "webXface"
},
"DeviceIndex": "1"
}
],
"Tags": [
{
"Key": "Role",
"Value": "Test Instance"
}
],
"UserData": {
"Fn::Base64": {
"Fn::Sub": "#!/bin/bash -xe\nyum install ec2-net-utils -y\nec2ifup eth1\nservice httpd start\n"
}
}
}
}
},
"Outputs": {
"InstancePublicIp": {
"Description": "Public IP Address of the EC2 Instance",
"Value": {
"Fn::GetAtt": [
"Ec2Instance",
"PublicIp"
]
}
}
}
```
#### YAML
```
Resources:
ControlPortAddress:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
AssociateControlPort:
Type: AWS::EC2::EIPAssociation
Properties:
AllocationId:
Fn::GetAtt:
- ControlPortAddress
- AllocationId
NetworkInterfaceId:
Ref: controlXface
WebPortAddress:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
AssociateWebPort:
Type: AWS::EC2::EIPAssociation
Properties:
AllocationId:
Fn::GetAtt:
- WebPortAddress
- AllocationId
NetworkInterfaceId:
Ref: webXface
SSHSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VpcId
GroupDescription: Enable SSH access via port 22
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
FromPort: 22
IpProtocol: tcp
ToPort: 22
WebSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VpcId
GroupDescription: Enable HTTP access via user-defined port
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
FromPort: 80
IpProtocol: tcp
ToPort: 80
controlXface:
Type: AWS::EC2::NetworkInterface
Properties:
SubnetId:
Ref: SubnetId
Description: Interface for controlling traffic such as SSH
GroupSet:
- Fn::GetAtt:
- SSHSecurityGroup
- GroupId
SourceDestCheck: true
Tags:
- Key: Network
Value: Control
webXface:
Type: AWS::EC2::NetworkInterface
Properties:
SubnetId:
Ref: SubnetId
Description: Interface for web traffic
GroupSet:
- Fn::GetAtt:
- WebSecurityGroup
- GroupId
SourceDestCheck: true
Tags:
- Key: Network
Value: Web
Ec2Instance:
Type: AWS::EC2::Instance
Properties:
ImageId:
Fn::FindInMap:
- RegionMap
- Ref: AWS::Region
- AMI
KeyName:
Ref: KeyName
NetworkInterfaces:
- NetworkInterfaceId:
Ref: controlXface
DeviceIndex: "0"
- NetworkInterfaceId:
Ref: webXface
DeviceIndex: "1"
Tags:
- Key: Role
Value: Test Instance
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
yum install ec2-net-utils -y
ec2ifup eth1
service httpd start
Outputs:
InstancePublicIp:
Description: Public IP Address of the EC2 Instance
Value:
Fn::GetAtt:
- Ec2Instance
- PublicIp
```
# Templat contoh Layanan Kontainer Elastis Amazon
Amazon Elastic Container Service (Amazon ECS) adalah layanan manajemen kontainer yang memudahkan untuk menjalankan, menghentikan, dan mengelola container Docker di cluster instans Amazon Elastic Compute Cloud (Amazon EC2).
## Buat cluster dengan AL2023 Amazon ECS-Optimized-AMI
Tentukan cluster yang menggunakan penyedia kapasitas yang meluncurkan instans AL2023 di Amazon EC2.
**penting**
Untuk AMI terbaru IDs, lihat AMI yang [dioptimalkan Amazon ECS di Panduan](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-optimized_AMI.html) *Pengembang Layanan Kontainer Elastis Amazon*.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "EC2 ECS cluster that starts out empty, with no EC2 instances yet. An ECS capacity provider automatically launches more EC2 instances as required on the fly when you request ECS to launch services or standalone tasks.",
"Parameters": {
"InstanceType": {
"Type": "String",
"Description": "EC2 instance type",
"Default": "t2.medium",
"AllowedValues": [
"t1.micro",
"t2.2xlarge",
"t2.large",
"t2.medium",
"t2.micro",
"t2.nano",
"t2.small",
"t2.xlarge",
"t3.2xlarge",
"t3.large",
"t3.medium",
"t3.micro",
"t3.nano",
"t3.small",
"t3.xlarge"
]
},
"DesiredCapacity": {
"Type": "Number",
"Default": "0",
"Description": "Number of EC2 instances to launch in your ECS cluster."
},
"MaxSize": {
"Type": "Number",
"Default": "100",
"Description": "Maximum number of EC2 instances that can be launched in your ECS cluster."
},
"ECSAMI": {
"Description": "The Amazon Machine Image ID used for the cluster",
"Type": "AWS::SSM::Parameter::Value",
"Default": "/aws/service/ecs/optimized-ami/amazon-linux-2023/recommended/image_id"
},
"VpcId": {
"Type": "AWS::EC2::VPC::Id",
"Description": "VPC ID where the ECS cluster is launched",
"Default": "vpc-1234567890abcdef0"
},
"SubnetIds": {
"Type": "List",
"Description": "List of subnet IDs where the EC2 instances will be launched",
"Default": "subnet-021345abcdef67890"
}
},
"Resources": {
"ECSCluster": {
"Type": "AWS::ECS::Cluster",
"Properties": {
"ClusterSettings": [
{
"Name": "containerInsights",
"Value": "enabled"
}
]
}
},
"ECSAutoScalingGroup": {
"Type": "AWS::AutoScaling::AutoScalingGroup",
"DependsOn": [
"ECSCluster",
"EC2Role"
],
"Properties": {
"VPCZoneIdentifier": {
"Ref": "SubnetIds"
},
"LaunchTemplate": {
"LaunchTemplateId": {
"Ref": "ContainerInstances"
},
"Version": {
"Fn::GetAtt": [
"ContainerInstances",
"LatestVersionNumber"
]
}
},
"MinSize": 0,
"MaxSize": {
"Ref": "MaxSize"
},
"DesiredCapacity": {
"Ref": "DesiredCapacity"
},
"NewInstancesProtectedFromScaleIn": true
},
"UpdatePolicy": {
"AutoScalingReplacingUpdate": {
"WillReplace": "true"
}
}
},
"ContainerInstances": {
"Type": "AWS::EC2::LaunchTemplate",
"Properties": {
"LaunchTemplateName": "asg-launch-template",
"LaunchTemplateData": {
"ImageId": {
"Ref": "ECSAMI"
},
"InstanceType": {
"Ref": "InstanceType"
},
"IamInstanceProfile": {
"Name": {
"Ref": "EC2InstanceProfile"
}
},
"SecurityGroupIds": [
{
"Ref": "ContainerHostSecurityGroup"
}
],
"UserData": {
"Fn::Base64": {
"Fn::Sub": "#!/bin/bash -xe\n echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config\n yum install -y aws-cfn-bootstrap\n /opt/aws/bin/cfn-init -v --stack ${AWS::StackId} --resource ContainerInstances --configsets full_install --region ${AWS::Region} &\n"
}
},
"MetadataOptions": {
"HttpEndpoint": "enabled",
"HttpTokens": "required"
}
}
}
},
"EC2InstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [
{
"Ref": "EC2Role"
}
]
}
},
"CapacityProvider": {
"Type": "AWS::ECS::CapacityProvider",
"Properties": {
"AutoScalingGroupProvider": {
"AutoScalingGroupArn": {
"Ref": "ECSAutoScalingGroup"
},
"ManagedScaling": {
"InstanceWarmupPeriod": 60,
"MinimumScalingStepSize": 1,
"MaximumScalingStepSize": 100,
"Status": "ENABLED",
"TargetCapacity": 100
},
"ManagedTerminationProtection": "ENABLED"
}
}
},
"CapacityProviderAssociation": {
"Type": "AWS::ECS::ClusterCapacityProviderAssociations",
"Properties": {
"CapacityProviders": [
{
"Ref": "CapacityProvider"
}
],
"Cluster": {
"Ref": "ECSCluster"
},
"DefaultCapacityProviderStrategy": [
{
"Base": 0,
"CapacityProvider": {
"Ref": "CapacityProvider"
},
"Weight": 1
}
]
}
},
"ContainerHostSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Access to the EC2 hosts that run containers",
"VpcId": {
"Ref": "VpcId"
}
}
},
"EC2Role": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Path": "/",
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role",
"arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
]
}
},
"ECSTaskExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ecs-tasks.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
],
"Condition": {
"ArnLike": {
"aws:SourceArn": {
"Fn::Sub": "arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:*"
}
},
"StringEquals": {
"aws:SourceAccount": {
"Fn::Sub": "${AWS::AccountId}"
}
}
}
}
]
},
"Path": "/",
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
]
}
}
},
"Outputs": {
"ClusterName": {
"Description": "The ECS cluster into which to launch resources",
"Value": "ECSCluster"
},
"ECSTaskExecutionRole": {
"Description": "The role used to start up a task",
"Value": "ECSTaskExecutionRole"
},
"CapacityProvider": {
"Description": "The cluster capacity provider that the service should use to request capacity when it wants to start up a task",
"Value": "CapacityProvider"
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: 2010-09-09
Description: EC2 ECS cluster that starts out empty, with no EC2 instances yet.
An ECS capacity provider automatically launches more EC2 instances as required
on the fly when you request ECS to launch services or standalone tasks.
Parameters:
InstanceType:
Type: String
Description: EC2 instance type
Default: "t2.medium"
AllowedValues:
- t1.micro
- t2.2xlarge
- t2.large
- t2.medium
- t2.micro
- t2.nano
- t2.small
- t2.xlarge
- t3.2xlarge
- t3.large
- t3.medium
- t3.micro
- t3.nano
- t3.small
- t3.xlarge
DesiredCapacity:
Type: Number
Default: "0"
Description: Number of EC2 instances to launch in your ECS cluster.
MaxSize:
Type: Number
Default: "100"
Description: Maximum number of EC2 instances that can be launched in your ECS cluster.
ECSAMI:
Description: The Amazon Machine Image ID used for the cluster
Type: AWS::SSM::Parameter::Value
Default: /aws/service/ecs/optimized-ami/amazon-linux-2023/recommended/image_id
VpcId:
Type: AWS::EC2::VPC::Id
Description: VPC ID where the ECS cluster is launched
Default: vpc-1234567890abcdef0
SubnetIds:
Type: List
Description: List of subnet IDs where the EC2 instances will be launched
Default: "subnet-021345abcdef67890"
Resources:
# This is authorizes ECS to manage resources on your
# account on your behalf. This role is likely already created on your account
# ECSRole:
# Type: AWS::IAM::ServiceLinkedRole
# Properties:
# AWSServiceName: 'ecs.amazonaws.com'
# ECS Resources
ECSCluster:
Type: AWS::ECS::Cluster
Properties:
ClusterSettings:
- Name: containerInsights
Value: enabled
# Autoscaling group. This launches the actual EC2 instances that will register
# themselves as members of the cluster, and run the docker containers.
ECSAutoScalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
DependsOn:
# This is to ensure that the ASG gets deleted first before these
# resources, when it comes to stack teardown.
- ECSCluster
- EC2Role
Properties:
VPCZoneIdentifier:
Ref: SubnetIds
LaunchTemplate:
LaunchTemplateId: !Ref ContainerInstances
Version: !GetAtt ContainerInstances.LatestVersionNumber
MinSize: 0
MaxSize:
Ref: MaxSize
DesiredCapacity:
Ref: DesiredCapacity
NewInstancesProtectedFromScaleIn: true
UpdatePolicy:
AutoScalingReplacingUpdate:
WillReplace: "true"
# The config for each instance that is added to the cluster
ContainerInstances:
Type: AWS::EC2::LaunchTemplate
Properties:
LaunchTemplateName: "asg-launch-template"
LaunchTemplateData:
ImageId:
Ref: ECSAMI
InstanceType:
Ref: InstanceType
IamInstanceProfile:
Name: !Ref EC2InstanceProfile
SecurityGroupIds:
- !Ref ContainerHostSecurityGroup
# This injected configuration file is how the EC2 instance
# knows which ECS cluster on your AWS account it should be joining
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
echo ECS_CLUSTER=${ECSCluster} >> /etc/ecs/ecs.config
yum install -y aws-cfn-bootstrap
/opt/aws/bin/cfn-init -v --stack ${AWS::StackId} --resource ContainerInstances --configsets full_install --region ${AWS::Region} &
# Disable IMDSv1, and require IMDSv2
MetadataOptions:
HttpEndpoint: enabled
HttpTokens: required
EC2InstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: /
Roles:
- !Ref EC2Role
# Create an ECS capacity provider to attach the ASG to the ECS cluster
# so that it autoscales as we launch more containers
CapacityProvider:
Type: AWS::ECS::CapacityProvider
Properties:
AutoScalingGroupProvider:
AutoScalingGroupArn: !Ref ECSAutoScalingGroup
ManagedScaling:
InstanceWarmupPeriod: 60
MinimumScalingStepSize: 1
MaximumScalingStepSize: 100
Status: ENABLED
# Percentage of cluster reservation to try to maintain
TargetCapacity: 100
ManagedTerminationProtection: ENABLED
# Create a cluster capacity provider assocation so that the cluster
# will use the capacity provider
CapacityProviderAssociation:
Type: AWS::ECS::ClusterCapacityProviderAssociations
Properties:
CapacityProviders:
- !Ref CapacityProvider
Cluster: !Ref ECSCluster
DefaultCapacityProviderStrategy:
- Base: 0
CapacityProvider: !Ref CapacityProvider
Weight: 1
# A security group for the EC2 hosts that will run the containers.
# This can be used to limit incoming traffic to or outgoing traffic
# from the container's host EC2 instance.
ContainerHostSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Access to the EC2 hosts that run containers
VpcId:
Ref: VpcId
# Role for the EC2 hosts. This allows the ECS agent on the EC2 hosts
# to communciate with the ECS control plane, as well as download the docker
# images from ECR to run on your host.
EC2Role:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: /
ManagedPolicyArns:
# See reference: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonEC2ContainerServiceforEC2Role
- arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceforEC2Role
# This managed policy allows us to connect to the instance using SSM
- arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
# This is a role which is used within Fargate to allow the Fargate agent
# to download images, and upload logs.
ECSTaskExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- ecs-tasks.amazonaws.com
Action:
- sts:AssumeRole
Condition:
ArnLike:
aws:SourceArn: !Sub arn:${AWS::Partition}:ecs:${AWS::Region}:${AWS::AccountId}:*
StringEquals:
aws:SourceAccount: !Sub ${AWS::AccountId}
Path: /
# This role enables all features of ECS. See reference:
# https://docs.aws.amazon.com/AmazonECS/latest/developerguide/security-iam-awsmanpol.html#security-iam-awsmanpol-AmazonECSTaskExecutionRolePolicy
ManagedPolicyArns:
- arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
Outputs:
ClusterName:
Description: The ECS cluster into which to launch resources
Value: ECSCluster
ECSTaskExecutionRole:
Description: The role used to start up a task
Value: ECSTaskExecutionRole
CapacityProvider:
Description: The cluster capacity provider that the service should use to
request capacity when it wants to start up a task
Value: CapacityProvider
```
## Menyebarkan layanan
Template berikut mendefinisikan layanan yang menggunakan penyedia kapasitas untuk meminta AL2023 kapasitas untuk dijalankan. Kontainer akan diluncurkan ke AL2023 instance saat online:
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "An example service that deploys in AWS VPC networking mode on EC2 capacity. Service uses a capacity provider to request EC2 instances to run on. Service runs with networking in private subnets, but still accessible to the internet via a load balancer hosted in public subnets.",
"Parameters": {
"VpcId": {
"Type": "String",
"Description": "The VPC that the service is running inside of"
},
"PublicSubnetIds": {
"Type": "List",
"Description": "List of public subnet ID's to put the load balancer in"
},
"PrivateSubnetIds": {
"Type": "List",
"Description": "List of private subnet ID's that the AWS VPC tasks are in"
},
"ClusterName": {
"Type": "String",
"Description": "The name of the ECS cluster into which to launch capacity."
},
"ECSTaskExecutionRole": {
"Type": "String",
"Description": "The role used to start up an ECS task"
},
"CapacityProvider": {
"Type": "String",
"Description": "The cluster capacity provider that the service should use to request capacity when it wants to start up a task"
},
"ServiceName": {
"Type": "String",
"Default": "web",
"Description": "A name for the service"
},
"ImageUrl": {
"Type": "String",
"Default": "public.ecr.aws/docker/library/nginx:latest",
"Description": "The url of a docker image that contains the application process that will handle the traffic for this service"
},
"ContainerCpu": {
"Type": "Number",
"Default": 256,
"Description": "How much CPU to give the container. 1024 is 1 CPU"
},
"ContainerMemory": {
"Type": "Number",
"Default": 512,
"Description": "How much memory in megabytes to give the container"
},
"ContainerPort": {
"Type": "Number",
"Default": 80,
"Description": "What port that the application expects traffic on"
},
"DesiredCount": {
"Type": "Number",
"Default": 2,
"Description": "How many copies of the service task to run"
}
},
"Resources": {
"TaskDefinition": {
"Type": "AWS::ECS::TaskDefinition",
"Properties": {
"Family": {
"Ref": "ServiceName"
},
"Cpu": {
"Ref": "ContainerCpu"
},
"Memory": {
"Ref": "ContainerMemory"
},
"NetworkMode": "awsvpc",
"RequiresCompatibilities": [
"EC2"
],
"ExecutionRoleArn": {
"Ref": "ECSTaskExecutionRole"
},
"ContainerDefinitions": [
{
"Name": {
"Ref": "ServiceName"
},
"Cpu": {
"Ref": "ContainerCpu"
},
"Memory": {
"Ref": "ContainerMemory"
},
"Image": {
"Ref": "ImageUrl"
},
"PortMappings": [
{
"ContainerPort": {
"Ref": "ContainerPort"
},
"HostPort": {
"Ref": "ContainerPort"
}
}
],
"LogConfiguration": {
"LogDriver": "awslogs",
"Options": {
"mode": "non-blocking",
"max-buffer-size": "25m",
"awslogs-group": {
"Ref": "LogGroup"
},
"awslogs-region": {
"Ref": "AWS::Region"
},
"awslogs-stream-prefix": {
"Ref": "ServiceName"
}
}
}
}
]
}
},
"Service": {
"Type": "AWS::ECS::Service",
"DependsOn": "PublicLoadBalancerListener",
"Properties": {
"ServiceName": {
"Ref": "ServiceName"
},
"Cluster": {
"Ref": "ClusterName"
},
"PlacementStrategies": [
{
"Field": "attribute:ecs.availability-zone",
"Type": "spread"
},
{
"Field": "cpu",
"Type": "binpack"
}
],
"CapacityProviderStrategy": [
{
"Base": 0,
"CapacityProvider": {
"Ref": "CapacityProvider"
},
"Weight": 1
}
],
"NetworkConfiguration": {
"AwsvpcConfiguration": {
"SecurityGroups": [
{
"Ref": "ServiceSecurityGroup"
}
],
"Subnets": {
"Ref": "PrivateSubnetIds"
}
}
},
"DeploymentConfiguration": {
"MaximumPercent": 200,
"MinimumHealthyPercent": 75
},
"DesiredCount": {
"Ref": "DesiredCount"
},
"TaskDefinition": {
"Ref": "TaskDefinition"
},
"LoadBalancers": [
{
"ContainerName": {
"Ref": "ServiceName"
},
"ContainerPort": {
"Ref": "ContainerPort"
},
"TargetGroupArn": {
"Ref": "ServiceTargetGroup"
}
}
]
}
},
"ServiceSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Security group for service",
"VpcId": {
"Ref": "VpcId"
}
}
},
"ServiceTargetGroup": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"HealthCheckIntervalSeconds": 6,
"HealthCheckPath": "/",
"HealthCheckProtocol": "HTTP",
"HealthCheckTimeoutSeconds": 5,
"HealthyThresholdCount": 2,
"TargetType": "ip",
"Port": {
"Ref": "ContainerPort"
},
"Protocol": "HTTP",
"UnhealthyThresholdCount": 10,
"VpcId": {
"Ref": "VpcId"
},
"TargetGroupAttributes": [
{
"Key": "deregistration_delay.timeout_seconds",
"Value": 0
}
]
}
},
"PublicLoadBalancerSG": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Access to the public facing load balancer",
"VpcId": {
"Ref": "VpcId"
},
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"IpProtocol": -1
}
]
}
},
"PublicLoadBalancer": {
"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties": {
"Scheme": "internet-facing",
"LoadBalancerAttributes": [
{
"Key": "idle_timeout.timeout_seconds",
"Value": "30"
}
],
"Subnets": {
"Ref": "PublicSubnetIds"
},
"SecurityGroups": [
{
"Ref": "PublicLoadBalancerSG"
}
]
}
},
"PublicLoadBalancerListener": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"Properties": {
"DefaultActions": [
{
"Type": "forward",
"ForwardConfig": {
"TargetGroups": [
{
"TargetGroupArn": {
"Ref": "ServiceTargetGroup"
},
"Weight": 100
}
]
}
}
],
"LoadBalancerArn": {
"Ref": "PublicLoadBalancer"
},
"Port": 80,
"Protocol": "HTTP"
}
},
"ServiceIngressfromLoadBalancer": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"Description": "Ingress from the public ALB",
"GroupId": {
"Ref": "ServiceSecurityGroup"
},
"IpProtocol": -1,
"SourceSecurityGroupId": {
"Ref": "PublicLoadBalancerSG"
}
}
},
"LogGroup": {
"Type": "AWS::Logs::LogGroup"
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Description: >-
An example service that deploys in AWS VPC networking mode on EC2 capacity.
Service uses a capacity provider to request EC2 instances to run on. Service
runs with networking in private subnets, but still accessible to the internet
via a load balancer hosted in public subnets.
Parameters:
VpcId:
Type: String
Description: The VPC that the service is running inside of
PublicSubnetIds:
Type: 'List'
Description: List of public subnet ID's to put the load balancer in
PrivateSubnetIds:
Type: 'List'
Description: List of private subnet ID's that the AWS VPC tasks are in
ClusterName:
Type: String
Description: The name of the ECS cluster into which to launch capacity.
ECSTaskExecutionRole:
Type: String
Description: The role used to start up an ECS task
CapacityProvider:
Type: String
Description: >-
The cluster capacity provider that the service should use to request
capacity when it wants to start up a task
ServiceName:
Type: String
Default: web
Description: A name for the service
ImageUrl:
Type: String
Default: 'public.ecr.aws/docker/library/nginx:latest'
Description: >-
The url of a docker image that contains the application process that will
handle the traffic for this service
ContainerCpu:
Type: Number
Default: 256
Description: How much CPU to give the container. 1024 is 1 CPU
ContainerMemory:
Type: Number
Default: 512
Description: How much memory in megabytes to give the container
ContainerPort:
Type: Number
Default: 80
Description: What port that the application expects traffic on
DesiredCount:
Type: Number
Default: 2
Description: How many copies of the service task to run
Resources:
TaskDefinition:
Type: AWS::ECS::TaskDefinition
Properties:
Family: !Ref ServiceName
Cpu: !Ref ContainerCpu
Memory: !Ref ContainerMemory
NetworkMode: awsvpc
RequiresCompatibilities:
- EC2
ExecutionRoleArn: !Ref ECSTaskExecutionRole
ContainerDefinitions:
- Name: !Ref ServiceName
Cpu: !Ref ContainerCpu
Memory: !Ref ContainerMemory
Image: !Ref ImageUrl
PortMappings:
- ContainerPort: !Ref ContainerPort
HostPort: !Ref ContainerPort
LogConfiguration:
LogDriver: awslogs
Options:
mode: non-blocking
max-buffer-size: 25m
awslogs-group: !Ref LogGroup
awslogs-region: !Ref AWS::Region
awslogs-stream-prefix: !Ref ServiceName
Service:
Type: AWS::ECS::Service
DependsOn: PublicLoadBalancerListener
Properties:
ServiceName: !Ref ServiceName
Cluster: !Ref ClusterName
PlacementStrategies:
- Field: 'attribute:ecs.availability-zone'
Type: spread
- Field: cpu
Type: binpack
CapacityProviderStrategy:
- Base: 0
CapacityProvider: !Ref CapacityProvider
Weight: 1
NetworkConfiguration:
AwsvpcConfiguration:
SecurityGroups:
- !Ref ServiceSecurityGroup
Subnets: !Ref PrivateSubnetIds
DeploymentConfiguration:
MaximumPercent: 200
MinimumHealthyPercent: 75
DesiredCount: !Ref DesiredCount
TaskDefinition: !Ref TaskDefinition
LoadBalancers:
- ContainerName: !Ref ServiceName
ContainerPort: !Ref ContainerPort
TargetGroupArn: !Ref ServiceTargetGroup
ServiceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group for service
VpcId: !Ref VpcId
ServiceTargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckIntervalSeconds: 6
HealthCheckPath: /
HealthCheckProtocol: HTTP
HealthCheckTimeoutSeconds: 5
HealthyThresholdCount: 2
TargetType: ip
Port: !Ref ContainerPort
Protocol: HTTP
UnhealthyThresholdCount: 10
VpcId: !Ref VpcId
TargetGroupAttributes:
- Key: deregistration_delay.timeout_seconds
Value: 0
PublicLoadBalancerSG:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Access to the public facing load balancer
VpcId: !Ref VpcId
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
IpProtocol: -1
PublicLoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Scheme: internet-facing
LoadBalancerAttributes:
- Key: idle_timeout.timeout_seconds
Value: '30'
Subnets: !Ref PublicSubnetIds
SecurityGroups:
- !Ref PublicLoadBalancerSG
PublicLoadBalancerListener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
DefaultActions:
- Type: forward
ForwardConfig:
TargetGroups:
- TargetGroupArn: !Ref ServiceTargetGroup
Weight: 100
LoadBalancerArn: !Ref PublicLoadBalancer
Port: 80
Protocol: HTTP
ServiceIngressfromLoadBalancer:
Type: AWS::EC2::SecurityGroupIngress
Properties:
Description: Ingress from the public ALB
GroupId: !Ref ServiceSecurityGroup
IpProtocol: -1
SourceSecurityGroupId: !Ref PublicLoadBalancerSG
LogGroup:
Type: AWS::Logs::LogGroup
```
# Templat Contoh Sistem File Elastis Amazon
Amazon Elastic File System (Amazon EFS) adalah layanan penyimpanan file untuk instans Amazon Elastic Compute Cloud (Amazon EC2). Dengan Amazon EFS, aplikasi Anda memiliki penyimpanan saat mereka membutuhkannya karena kapasitas penyimpanan tumbuh dan menyusut secara otomatis saat Anda menambah dan menghapus file.
Contoh template berikut menerapkan EC2 instance (dalam grup Auto Scaling) yang terkait dengan sistem file Amazon EFS. Untuk mengaitkan instans dengan sistem file, instans menjalankan skrip pembantu cfn-init, yang mengunduh dan menginstal paket yum `nfs-utils`, membuat direktori baru, lalu menggunakan nama DNS sistem file untuk memasang sistem file pada direktori tersebut. Nama DNS sistem file diselesaikan ke alamat IP target mount di Availability Zone EC2 instans Amazon. Untuk informasi selengkapnya tentang struktur nama DNS, lihat [Memasang Sistem File](https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html) di *Panduan Pengguna Amazon Elastic File System*.
Untuk mengukur aktivitas Sistem File Jaringan, template menyertakan CloudWatch metrik Amazon khusus. Templat juga membuat VPC, subnet, dan grup keamanan. Untuk memungkinkan instance berkomunikasi dengan sistem file, VPC harus mengaktifkan DNS, dan target pemasangan dan instance harus berada di Availability Zone (AZ) yang sama, yang ditentukan oleh subnet. EC2
Kelompok keamanan target mount memungkinkan koneksi jaringan ke port TCP 2049, yang diperlukan untuk NFSv4 klien untuk me-mount sistem file. Untuk informasi selengkapnya tentang grup keamanan untuk EC2 instans dan target pemasangan, lihat [Keamanan](https://docs.aws.amazon.com/efs/latest/ug/security-considerations.html) di [https://docs.aws.amazon.com/efs/latest/ug/](https://docs.aws.amazon.com/efs/latest/ug/).
**catatan**
Jika Anda membuat pembaruan ke target pemasangan yang menyebabkannya diganti, instans atau aplikasi yang menggunakan sistem file terkait mungkin terganggu. Hal ini dapat menyebabkan penulisan tidak berkomitmen hilang. Untuk menghindari gangguan, hentikan instans Anda saat memperbarui target pemasangan dengan mengatur kapasitas yang diinginkan ke nol. Hal ini memungkinkan instans untuk membongkar sistem file sebelum target pemasangan dihapus. Setelah pembaruan pemasangan selesai, mulailah instans Anda dalam pembaruan berikutnya dengan mengatur kapasitas yang diinginkan.
## JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "This template creates an Amazon EFS file system and mount target and associates it with Amazon EC2 instances in an Auto Scaling group. **WARNING** This template creates Amazon EC2 instances and related resources. You will be billed for the AWS resources used if you create a stack from this template.",
"Parameters": {
"InstanceType" : {
"Description" : "WebServer EC2 instance type",
"Type" : "String",
"Default" : "t2.small",
"AllowedValues" : [
"t1.micro",
"t2.nano",
"t2.micro",
"t2.small",
"t2.medium",
"t2.large",
"m1.small",
"m1.medium",
"m1.large",
"m1.xlarge",
"m2.xlarge",
"m2.2xlarge",
"m2.4xlarge",
"m3.medium",
"m3.large",
"m3.xlarge",
"m3.2xlarge",
"m4.large",
"m4.xlarge",
"m4.2xlarge",
"m4.4xlarge",
"m4.10xlarge",
"c1.medium",
"c1.xlarge",
"c3.large",
"c3.xlarge",
"c3.2xlarge",
"c3.4xlarge",
"c3.8xlarge",
"c4.large",
"c4.xlarge",
"c4.2xlarge",
"c4.4xlarge",
"c4.8xlarge",
"g2.2xlarge",
"g2.8xlarge",
"r3.large",
"r3.xlarge",
"r3.2xlarge",
"r3.4xlarge",
"r3.8xlarge",
"i2.xlarge",
"i2.2xlarge",
"i2.4xlarge",
"i2.8xlarge",
"d2.xlarge",
"d2.2xlarge",
"d2.4xlarge",
"d2.8xlarge",
"hi1.4xlarge",
"hs1.8xlarge",
"cr1.8xlarge",
"cc2.8xlarge",
"cg1.4xlarge"
],
"ConstraintDescription" : "must be a valid EC2 instance type."
},
"KeyName": {
"Type": "AWS::EC2::KeyPair::KeyName",
"Description": "Name of an existing EC2 key pair to enable SSH access to the EC2 instances"
},
"AsgMaxSize": {
"Type": "Number",
"Description": "Maximum size and initial desired capacity of Auto Scaling Group",
"Default": "2"
},
"SSHLocation" : {
"Description" : "The IP address range that can be used to connect to the EC2 instances by using SSH",
"Type": "String",
"MinLength": "9",
"MaxLength": "18",
"Default": "0.0.0.0/0",
"AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
"ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
},
"VolumeName" : {
"Description" : "The name to be used for the EFS volume",
"Type": "String",
"MinLength": "1",
"Default": "myEFSvolume"
},
"MountPoint" : {
"Description" : "The Linux mount point for the EFS volume",
"Type": "String",
"MinLength": "1",
"Default": "myEFSvolume"
}
},
"Mappings" : {
"AWSInstanceType2Arch" : {
"t1.micro" : { "Arch" : "HVM64" },
"t2.nano" : { "Arch" : "HVM64" },
"t2.micro" : { "Arch" : "HVM64" },
"t2.small" : { "Arch" : "HVM64" },
"t2.medium" : { "Arch" : "HVM64" },
"t2.large" : { "Arch" : "HVM64" },
"m1.small" : { "Arch" : "HVM64" },
"m1.medium" : { "Arch" : "HVM64" },
"m1.large" : { "Arch" : "HVM64" },
"m1.xlarge" : { "Arch" : "HVM64" },
"m2.xlarge" : { "Arch" : "HVM64" },
"m2.2xlarge" : { "Arch" : "HVM64" },
"m2.4xlarge" : { "Arch" : "HVM64" },
"m3.medium" : { "Arch" : "HVM64" },
"m3.large" : { "Arch" : "HVM64" },
"m3.xlarge" : { "Arch" : "HVM64" },
"m3.2xlarge" : { "Arch" : "HVM64" },
"m4.large" : { "Arch" : "HVM64" },
"m4.xlarge" : { "Arch" : "HVM64" },
"m4.2xlarge" : { "Arch" : "HVM64" },
"m4.4xlarge" : { "Arch" : "HVM64" },
"m4.10xlarge" : { "Arch" : "HVM64" },
"c1.medium" : { "Arch" : "HVM64" },
"c1.xlarge" : { "Arch" : "HVM64" },
"c3.large" : { "Arch" : "HVM64" },
"c3.xlarge" : { "Arch" : "HVM64" },
"c3.2xlarge" : { "Arch" : "HVM64" },
"c3.4xlarge" : { "Arch" : "HVM64" },
"c3.8xlarge" : { "Arch" : "HVM64" },
"c4.large" : { "Arch" : "HVM64" },
"c4.xlarge" : { "Arch" : "HVM64" },
"c4.2xlarge" : { "Arch" : "HVM64" },
"c4.4xlarge" : { "Arch" : "HVM64" },
"c4.8xlarge" : { "Arch" : "HVM64" },
"g2.2xlarge" : { "Arch" : "HVMG2" },
"g2.8xlarge" : { "Arch" : "HVMG2" },
"r3.large" : { "Arch" : "HVM64" },
"r3.xlarge" : { "Arch" : "HVM64" },
"r3.2xlarge" : { "Arch" : "HVM64" },
"r3.4xlarge" : { "Arch" : "HVM64" },
"r3.8xlarge" : { "Arch" : "HVM64" },
"i2.xlarge" : { "Arch" : "HVM64" },
"i2.2xlarge" : { "Arch" : "HVM64" },
"i2.4xlarge" : { "Arch" : "HVM64" },
"i2.8xlarge" : { "Arch" : "HVM64" },
"d2.xlarge" : { "Arch" : "HVM64" },
"d2.2xlarge" : { "Arch" : "HVM64" },
"d2.4xlarge" : { "Arch" : "HVM64" },
"d2.8xlarge" : { "Arch" : "HVM64" },
"hi1.4xlarge" : { "Arch" : "HVM64" },
"hs1.8xlarge" : { "Arch" : "HVM64" },
"cr1.8xlarge" : { "Arch" : "HVM64" },
"cc2.8xlarge" : { "Arch" : "HVM64" }
},
"AWSRegionArch2AMI" : {
"us-east-1" : {"HVM64" : "ami-0ff8a91507f77f867", "HVMG2" : "ami-0a584ac55a7631c0c"},
"us-west-2" : {"HVM64" : "ami-a0cfeed8", "HVMG2" : "ami-0e09505bc235aa82d"},
"us-west-1" : {"HVM64" : "ami-0bdb828fd58c52235", "HVMG2" : "ami-066ee5fd4a9ef77f1"},
"eu-west-1" : {"HVM64" : "ami-047bb4163c506cd98", "HVMG2" : "ami-0a7c483d527806435"},
"eu-west-2" : {"HVM64" : "ami-f976839e", "HVMG2" : "NOT_SUPPORTED"},
"eu-west-3" : {"HVM64" : "ami-0ebc281c20e89ba4b", "HVMG2" : "NOT_SUPPORTED"},
"eu-central-1" : {"HVM64" : "ami-0233214e13e500f77", "HVMG2" : "ami-06223d46a6d0661c7"},
"ap-northeast-1" : {"HVM64" : "ami-06cd52961ce9f0d85", "HVMG2" : "ami-053cdd503598e4a9d"},
"ap-northeast-2" : {"HVM64" : "ami-0a10b2721688ce9d2", "HVMG2" : "NOT_SUPPORTED"},
"ap-northeast-3" : {"HVM64" : "ami-0d98120a9fb693f07", "HVMG2" : "NOT_SUPPORTED"},
"ap-southeast-1" : {"HVM64" : "ami-08569b978cc4dfa10", "HVMG2" : "ami-0be9df32ae9f92309"},
"ap-southeast-2" : {"HVM64" : "ami-09b42976632b27e9b", "HVMG2" : "ami-0a9ce9fecc3d1daf8"},
"ap-south-1" : {"HVM64" : "ami-0912f71e06545ad88", "HVMG2" : "ami-097b15e89dbdcfcf4"},
"us-east-2" : {"HVM64" : "ami-0b59bfac6be064b78", "HVMG2" : "NOT_SUPPORTED"},
"ca-central-1" : {"HVM64" : "ami-0b18956f", "HVMG2" : "NOT_SUPPORTED"},
"sa-east-1" : {"HVM64" : "ami-07b14488da8ea02a0", "HVMG2" : "NOT_SUPPORTED"},
"cn-north-1" : {"HVM64" : "ami-0a4eaf6c4454eda75", "HVMG2" : "NOT_SUPPORTED"},
"cn-northwest-1" : {"HVM64" : "ami-6b6a7d09", "HVMG2" : "NOT_SUPPORTED"}
}
},
"Resources": {
"CloudWatchPutMetricsRole" : {
"Type" : "AWS::IAM::Role",
"Properties" : {
"AssumeRolePolicyDocument" : {
"Statement" : [ {
"Effect" : "Allow",
"Principal" : {
"Service" : [ "ec2.amazonaws.com" ]
},
"Action" : [ "sts:AssumeRole" ]
} ]
},
"Path" : "/"
}
},
"CloudWatchPutMetricsRolePolicy" : {
"Type" : "AWS::IAM::Policy",
"Properties" : {
"PolicyName" : "CloudWatch_PutMetricData",
"PolicyDocument" : {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CloudWatchPutMetricData",
"Effect": "Allow",
"Action": ["cloudwatch:PutMetricData"],
"Resource": ["*"]
}
]
},
"Roles" : [ { "Ref" : "CloudWatchPutMetricsRole" } ]
}
},
"CloudWatchPutMetricsInstanceProfile" : {
"Type" : "AWS::IAM::InstanceProfile",
"Properties" : {
"Path" : "/",
"Roles" : [ { "Ref" : "CloudWatchPutMetricsRole" } ]
}
},
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"EnableDnsSupport" : "true",
"EnableDnsHostnames" : "true",
"CidrBlock": "10.0.0.0/16",
"Tags": [ {"Key": "Application", "Value": { "Ref": "AWS::StackId"} } ]
}
},
"InternetGateway" : {
"Type" : "AWS::EC2::InternetGateway",
"Properties" : {
"Tags" : [
{ "Key" : "Application", "Value" : { "Ref" : "AWS::StackName" } },
{ "Key" : "Network", "Value" : "Public" }
]
}
},
"GatewayToInternet" : {
"Type" : "AWS::EC2::VPCGatewayAttachment",
"Properties" : {
"VpcId" : { "Ref" : "VPC" },
"InternetGatewayId" : { "Ref" : "InternetGateway" }
}
},
"RouteTable":{
"Type":"AWS::EC2::RouteTable",
"Properties":{
"VpcId": {"Ref":"VPC"}
}
},
"SubnetRouteTableAssoc": {
"Type" : "AWS::EC2::SubnetRouteTableAssociation",
"Properties" : {
"RouteTableId" : {"Ref":"RouteTable"},
"SubnetId" : {"Ref":"Subnet"}
}
},
"InternetGatewayRoute": {
"Type":"AWS::EC2::Route",
"Properties":{
"DestinationCidrBlock":"0.0.0.0/0",
"RouteTableId":{"Ref":"RouteTable"},
"GatewayId":{"Ref":"InternetGateway"}
}
},
"Subnet": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": { "Ref": "VPC" },
"CidrBlock": "10.0.0.0/24",
"Tags": [ { "Key": "Application", "Value": { "Ref": "AWS::StackId" } } ]
}
},
"InstanceSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": { "Ref": "VPC" },
"GroupDescription": "Enable SSH access via port 22",
"SecurityGroupIngress": [
{ "IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "CidrIp": { "Ref": "SSHLocation" } },
{ "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0" }
]
}
},
"MountTargetSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": { "Ref": "VPC" },
"GroupDescription": "Security group for mount target",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 2049,
"ToPort": 2049,
"CidrIp": "0.0.0.0/0"
}
]
}
},
"FileSystem": {
"Type": "AWS::EFS::FileSystem",
"Properties": {
"PerformanceMode": "generalPurpose",
"FileSystemTags": [
{
"Key": "Name",
"Value": { "Ref" : "VolumeName" }
}
]
}
},
"MountTarget": {
"Type": "AWS::EFS::MountTarget",
"Properties": {
"FileSystemId": { "Ref": "FileSystem" },
"SubnetId": { "Ref": "Subnet" },
"SecurityGroups": [ { "Ref": "MountTargetSecurityGroup" } ]
}
},
"LaunchConfiguration": {
"Type": "AWS::AutoScaling::LaunchConfiguration",
"Metadata" : {
"AWS::CloudFormation::Init" : {
"configSets" : {
"MountConfig" : [ "setup", "mount" ]
},
"setup" : {
"packages" : {
"yum" : {
"nfs-utils" : []
}
},
"files" : {
"/home/ec2-user/post_nfsstat" : {
"content" : { "Fn::Join" : [ "", [
"#!/bin/bash\n",
"\n",
"INPUT=\"$(cat)\"\n",
"CW_JSON_OPEN='{ \"Namespace\": \"EFS\", \"MetricData\": [ '\n",
"CW_JSON_CLOSE=' ] }'\n",
"CW_JSON_METRIC=''\n",
"METRIC_COUNTER=0\n",
"\n",
"for COL in 1 2 3 4 5 6; do\n",
"\n",
" COUNTER=0\n",
" METRIC_FIELD=$COL\n",
" DATA_FIELD=$(($COL+($COL-1)))\n",
"\n",
" while read line; do\n",
" if [[ COUNTER -gt 0 ]]; then\n",
"\n",
" LINE=`echo $line | tr -s ' ' `\n",
" AWS_COMMAND=\"aws cloudwatch put-metric-data --region ", { "Ref": "AWS::Region" }, "\"\n",
" MOD=$(( $COUNTER % 2))\n",
"\n",
" if [ $MOD -eq 1 ]; then\n",
" METRIC_NAME=`echo $LINE | cut -d ' ' -f $METRIC_FIELD`\n",
" else\n",
" METRIC_VALUE=`echo $LINE | cut -d ' ' -f $DATA_FIELD`\n",
" fi\n",
"\n",
" if [[ -n \"$METRIC_NAME\" && -n \"$METRIC_VALUE\" ]]; then\n",
" INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)\n",
" CW_JSON_METRIC=\"$CW_JSON_METRIC { \\\"MetricName\\\": \\\"$METRIC_NAME\\\", \\\"Dimensions\\\": [{\\\"Name\\\": \\\"InstanceId\\\", \\\"Value\\\": \\\"$INSTANCE_ID\\\"} ], \\\"Value\\\": $METRIC_VALUE },\"\n",
" unset METRIC_NAME\n",
" unset METRIC_VALUE\n",
"\n",
" METRIC_COUNTER=$((METRIC_COUNTER+1))\n",
" if [ $METRIC_COUNTER -eq 20 ]; then\n",
" # 20 is max metric collection size, so we have to submit here\n",
" aws cloudwatch put-metric-data --region ", { "Ref": "AWS::Region" }, " --cli-input-json \"`echo $CW_JSON_OPEN ${CW_JSON_METRIC%?} $CW_JSON_CLOSE`\"\n",
"\n",
" # reset\n",
" METRIC_COUNTER=0\n",
" CW_JSON_METRIC=''\n",
" fi\n",
" fi \n",
"\n",
"\n",
"\n",
" COUNTER=$((COUNTER+1))\n",
" fi\n",
"\n",
" if [[ \"$line\" == \"Client nfs v4:\" ]]; then\n",
" # the next line is the good stuff \n",
" COUNTER=$((COUNTER+1))\n",
" fi\n",
" done <<< \"$INPUT\"\n",
"done\n",
"\n",
"# submit whatever is left\n",
"aws cloudwatch put-metric-data --region ", { "Ref": "AWS::Region" }, " --cli-input-json \"`echo $CW_JSON_OPEN ${CW_JSON_METRIC%?} $CW_JSON_CLOSE`\""
] ] },
"mode": "000755",
"owner": "ec2-user",
"group": "ec2-user"
},
"/home/ec2-user/crontab" : {
"content" : { "Fn::Join" : [ "", [
"* * * * * /usr/sbin/nfsstat | /home/ec2-user/post_nfsstat\n"
] ] },
"owner": "ec2-user",
"group": "ec2-user"
}
},
"commands" : {
"01_createdir" : {
"command" : {"Fn::Join" : [ "", [ "mkdir /", { "Ref" : "MountPoint" }]]}
}
}
},
"mount" : {
"commands" : {
"01_mount" : {
"command" : { "Fn::Sub": "sudo mount -t nfs4 -o nfsvers=4.1,rsize=1048576,wsize=1048576,hard,timeo=600,retrans=2 ${FileSystem}.efs.${AWS::Region}.amazonaws.com:/ /${MountPoint}"}
},
"02_permissions" : {
"command" : {"Fn::Join" : [ "", [ "chown ec2-user:ec2-user /", { "Ref" : "MountPoint" }]]}
}
}
}
}
},
"Properties": {
"AssociatePublicIpAddress" : true,
"ImageId": {
"Fn::FindInMap": [ "AWSRegionArch2AMI", { "Ref": "AWS::Region" }, {
"Fn::FindInMap": [ "AWSInstanceType2Arch", { "Ref": "InstanceType" }, "Arch" ]
} ]
},
"InstanceType": { "Ref": "InstanceType" },
"KeyName": { "Ref": "KeyName" },
"SecurityGroups": [ { "Ref": "InstanceSecurityGroup" } ],
"IamInstanceProfile" : { "Ref" : "CloudWatchPutMetricsInstanceProfile" },
"UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -xe\n",
"yum install -y aws-cfn-bootstrap\n",
"/opt/aws/bin/cfn-init -v ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource LaunchConfiguration ",
" --configsets MountConfig ",
" --region ", { "Ref" : "AWS::Region" }, "\n",
"crontab /home/ec2-user/crontab\n",
"/opt/aws/bin/cfn-signal -e $? ",
" --stack ", { "Ref" : "AWS::StackName" },
" --resource AutoScalingGroup ",
" --region ", { "Ref" : "AWS::Region" }, "\n"
]]}}
}
},
"AutoScalingGroup": {
"Type": "AWS::AutoScaling::AutoScalingGroup",
"DependsOn": ["MountTarget", "GatewayToInternet"],
"CreationPolicy" : {
"ResourceSignal" : {
"Timeout" : "PT15M",
"Count" : { "Ref": "AsgMaxSize" }
}
},
"Properties": {
"VPCZoneIdentifier": [ { "Ref": "Subnet" } ],
"LaunchConfigurationName": { "Ref": "LaunchConfiguration" },
"MinSize": "1",
"MaxSize": { "Ref": "AsgMaxSize" },
"DesiredCapacity": { "Ref": "AsgMaxSize" },
"Tags": [ {
"Key": "Name",
"Value": "EFS FileSystem Mounted Instance",
"PropagateAtLaunch": "true"
} ]
}
}
},
"Outputs" : {
"MountTargetID" : {
"Description" : "Mount target ID",
"Value" : { "Ref" : "MountTarget" }
},
"FileSystemID" : {
"Description" : "File system ID",
"Value" : { "Ref" : "FileSystem" }
}
}
}
```
## YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Description: This template creates an Amazon EFS file system and mount target and
associates it with Amazon EC2 instances in an Auto Scaling group. **WARNING** This
template creates Amazon EC2 instances and related resources. You will be billed
for the AWS resources used if you create a stack from this template.
Parameters:
InstanceType:
Description: WebServer EC2 instance type
Type: String
Default: t2.small
AllowedValues:
- t1.micro
- t2.nano
- t2.micro
- t2.small
- t2.medium
- t2.large
- m1.small
- m1.medium
- m1.large
- m1.xlarge
- m2.xlarge
- m2.2xlarge
- m2.4xlarge
- m3.medium
- m3.large
- m3.xlarge
- m3.2xlarge
- m4.large
- m4.xlarge
- m4.2xlarge
- m4.4xlarge
- m4.10xlarge
- c1.medium
- c1.xlarge
- c3.large
- c3.xlarge
- c3.2xlarge
- c3.4xlarge
- c3.8xlarge
- c4.large
- c4.xlarge
- c4.2xlarge
- c4.4xlarge
- c4.8xlarge
- g2.2xlarge
- g2.8xlarge
- r3.large
- r3.xlarge
- r3.2xlarge
- r3.4xlarge
- r3.8xlarge
- i2.xlarge
- i2.2xlarge
- i2.4xlarge
- i2.8xlarge
- d2.xlarge
- d2.2xlarge
- d2.4xlarge
- d2.8xlarge
- hi1.4xlarge
- hs1.8xlarge
- cr1.8xlarge
- cc2.8xlarge
- cg1.4xlarge
ConstraintDescription: must be a valid EC2 instance type.
KeyName:
Type: AWS::EC2::KeyPair::KeyName
Description: Name of an existing EC2 key pair to enable SSH access to the ECS
instances
AsgMaxSize:
Type: Number
Description: Maximum size and initial desired capacity of Auto Scaling Group
Default: '2'
SSHLocation:
Description: The IP address range that can be used to connect to the EC2 instances
by using SSH
Type: String
MinLength: '9'
MaxLength: '18'
Default: 0.0.0.0/0
AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
VolumeName:
Description: The name to be used for the EFS volume
Type: String
MinLength: '1'
Default: myEFSvolume
MountPoint:
Description: The Linux mount point for the EFS volume
Type: String
MinLength: '1'
Default: myEFSvolume
Mappings:
AWSInstanceType2Arch:
t1.micro:
Arch: HVM64
t2.nano:
Arch: HVM64
t2.micro:
Arch: HVM64
t2.small:
Arch: HVM64
t2.medium:
Arch: HVM64
t2.large:
Arch: HVM64
m1.small:
Arch: HVM64
m1.medium:
Arch: HVM64
m1.large:
Arch: HVM64
m1.xlarge:
Arch: HVM64
m2.xlarge:
Arch: HVM64
m2.2xlarge:
Arch: HVM64
m2.4xlarge:
Arch: HVM64
m3.medium:
Arch: HVM64
m3.large:
Arch: HVM64
m3.xlarge:
Arch: HVM64
m3.2xlarge:
Arch: HVM64
m4.large:
Arch: HVM64
m4.xlarge:
Arch: HVM64
m4.2xlarge:
Arch: HVM64
m4.4xlarge:
Arch: HVM64
m4.10xlarge:
Arch: HVM64
c1.medium:
Arch: HVM64
c1.xlarge:
Arch: HVM64
c3.large:
Arch: HVM64
c3.xlarge:
Arch: HVM64
c3.2xlarge:
Arch: HVM64
c3.4xlarge:
Arch: HVM64
c3.8xlarge:
Arch: HVM64
c4.large:
Arch: HVM64
c4.xlarge:
Arch: HVM64
c4.2xlarge:
Arch: HVM64
c4.4xlarge:
Arch: HVM64
c4.8xlarge:
Arch: HVM64
g2.2xlarge:
Arch: HVMG2
g2.8xlarge:
Arch: HVMG2
r3.large:
Arch: HVM64
r3.xlarge:
Arch: HVM64
r3.2xlarge:
Arch: HVM64
r3.4xlarge:
Arch: HVM64
r3.8xlarge:
Arch: HVM64
i2.xlarge:
Arch: HVM64
i2.2xlarge:
Arch: HVM64
i2.4xlarge:
Arch: HVM64
i2.8xlarge:
Arch: HVM64
d2.xlarge:
Arch: HVM64
d2.2xlarge:
Arch: HVM64
d2.4xlarge:
Arch: HVM64
d2.8xlarge:
Arch: HVM64
hi1.4xlarge:
Arch: HVM64
hs1.8xlarge:
Arch: HVM64
cr1.8xlarge:
Arch: HVM64
cc2.8xlarge:
Arch: HVM64
AWSRegionArch2AMI:
us-east-1:
HVM64: ami-0ff8a91507f77f867
HVMG2: ami-0a584ac55a7631c0c
us-west-2:
HVM64: ami-a0cfeed8
HVMG2: ami-0e09505bc235aa82d
us-west-1:
HVM64: ami-0bdb828fd58c52235
HVMG2: ami-066ee5fd4a9ef77f1
eu-west-1:
HVM64: ami-047bb4163c506cd98
HVMG2: ami-0a7c483d527806435
eu-west-2:
HVM64: ami-f976839e
HVMG2: NOT_SUPPORTED
eu-west-3:
HVM64: ami-0ebc281c20e89ba4b
HVMG2: NOT_SUPPORTED
eu-central-1:
HVM64: ami-0233214e13e500f77
HVMG2: ami-06223d46a6d0661c7
ap-northeast-1:
HVM64: ami-06cd52961ce9f0d85
HVMG2: ami-053cdd503598e4a9d
ap-northeast-2:
HVM64: ami-0a10b2721688ce9d2
HVMG2: NOT_SUPPORTED
ap-northeast-3:
HVM64: ami-0d98120a9fb693f07
HVMG2: NOT_SUPPORTED
ap-southeast-1:
HVM64: ami-08569b978cc4dfa10
HVMG2: ami-0be9df32ae9f92309
ap-southeast-2:
HVM64: ami-09b42976632b27e9b
HVMG2: ami-0a9ce9fecc3d1daf8
ap-south-1:
HVM64: ami-0912f71e06545ad88
HVMG2: ami-097b15e89dbdcfcf4
us-east-2:
HVM64: ami-0b59bfac6be064b78
HVMG2: NOT_SUPPORTED
ca-central-1:
HVM64: ami-0b18956f
HVMG2: NOT_SUPPORTED
sa-east-1:
HVM64: ami-07b14488da8ea02a0
HVMG2: NOT_SUPPORTED
cn-north-1:
HVM64: ami-0a4eaf6c4454eda75
HVMG2: NOT_SUPPORTED
cn-northwest-1:
HVM64: ami-6b6a7d09
HVMG2: NOT_SUPPORTED
Resources:
CloudWatchPutMetricsRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
CloudWatchPutMetricsRolePolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: CloudWatch_PutMetricData
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: CloudWatchPutMetricData
Effect: Allow
Action:
- cloudwatch:PutMetricData
Resource:
- "*"
Roles:
- Ref: CloudWatchPutMetricsRole
CloudWatchPutMetricsInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: "/"
Roles:
- Ref: CloudWatchPutMetricsRole
VPC:
Type: AWS::EC2::VPC
Properties:
EnableDnsSupport: 'true'
EnableDnsHostnames: 'true'
CidrBlock: 10.0.0.0/16
Tags:
- Key: Application
Value:
Ref: AWS::StackId
InternetGateway:
Type: AWS::EC2::InternetGateway
Properties:
Tags:
- Key: Application
Value:
Ref: AWS::StackName
- Key: Network
Value: Public
GatewayToInternet:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId:
Ref: VPC
InternetGatewayId:
Ref: InternetGateway
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: VPC
SubnetRouteTableAssoc:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId:
Ref: RouteTable
SubnetId:
Ref: Subnet
InternetGatewayRoute:
Type: AWS::EC2::Route
Properties:
DestinationCidrBlock: 0.0.0.0/0
RouteTableId:
Ref: RouteTable
GatewayId:
Ref: InternetGateway
Subnet:
Type: AWS::EC2::Subnet
Properties:
VpcId:
Ref: VPC
CidrBlock: 10.0.0.0/24
Tags:
- Key: Application
Value:
Ref: AWS::StackId
InstanceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VPC
GroupDescription: Enable SSH access via port 22
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp:
Ref: SSHLocation
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
MountTargetSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VPC
GroupDescription: Security group for mount target
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 2049
ToPort: 2049
CidrIp: 0.0.0.0/0
FileSystem:
Type: AWS::EFS::FileSystem
Properties:
PerformanceMode: generalPurpose
FileSystemTags:
- Key: Name
Value:
Ref: VolumeName
MountTarget:
Type: AWS::EFS::MountTarget
Properties:
FileSystemId:
Ref: FileSystem
SubnetId:
Ref: Subnet
SecurityGroups:
- Ref: MountTargetSecurityGroup
LaunchConfiguration:
Type: AWS::AutoScaling::LaunchConfiguration
Metadata:
AWS::CloudFormation::Init:
configSets:
MountConfig:
- setup
- mount
setup:
packages:
yum:
nfs-utils: []
files:
"/home/ec2-user/post_nfsstat":
content: !Sub |
#!/bin/bash
INPUT="$(cat)"
CW_JSON_OPEN='{ "Namespace": "EFS", "MetricData": [ '
CW_JSON_CLOSE=' ] }'
CW_JSON_METRIC=''
METRIC_COUNTER=0
for COL in 1 2 3 4 5 6; do
COUNTER=0
METRIC_FIELD=$COL
DATA_FIELD=$(($COL+($COL-1)))
while read line; do
if [[ COUNTER -gt 0 ]]; then
LINE=`echo $line | tr -s ' ' `
AWS_COMMAND="aws cloudwatch put-metric-data --region ${AWS::Region}"
MOD=$(( $COUNTER % 2))
if [ $MOD -eq 1 ]; then
METRIC_NAME=`echo $LINE | cut -d ' ' -f $METRIC_FIELD`
else
METRIC_VALUE=`echo $LINE | cut -d ' ' -f $DATA_FIELD`
fi
if [[ -n "$METRIC_NAME" && -n "$METRIC_VALUE" ]]; then
INSTANCE_ID=$(curl -s http://169.254.169.254/latest/meta-data/instance-id)
CW_JSON_METRIC="$CW_JSON_METRIC { \"MetricName\": \"$METRIC_NAME\", \"Dimensions\": [{\"Name\": \"InstanceId\", \"Value\": \"$INSTANCE_ID\"} ], \"Value\": $METRIC_VALUE },"
unset METRIC_NAME
unset METRIC_VALUE
METRIC_COUNTER=$((METRIC_COUNTER+1))
if [ $METRIC_COUNTER -eq 20 ]; then
# 20 is max metric collection size, so we have to submit here
aws cloudwatch put-metric-data --region ${AWS::Region} --cli-input-json "`echo $CW_JSON_OPEN ${!CW_JSON_METRIC%?} $CW_JSON_CLOSE`"
# reset
METRIC_COUNTER=0
CW_JSON_METRIC=''
fi
fi
COUNTER=$((COUNTER+1))
fi
if [[ "$line" == "Client nfs v4:" ]]; then
# the next line is the good stuff
COUNTER=$((COUNTER+1))
fi
done <<< "$INPUT"
done
# submit whatever is left
aws cloudwatch put-metric-data --region ${AWS::Region} --cli-input-json "`echo $CW_JSON_OPEN ${!CW_JSON_METRIC%?} $CW_JSON_CLOSE`"
mode: '000755'
owner: ec2-user
group: ec2-user
"/home/ec2-user/crontab":
content: "* * * * * /usr/sbin/nfsstat | /home/ec2-user/post_nfsstat\n"
owner: ec2-user
group: ec2-user
commands:
01_createdir:
command: !Sub "mkdir /${MountPoint}"
mount:
commands:
01_mount:
command: !Sub >
mount -t nfs4 -o nfsvers=4.1 ${FileSystem}.efs.${AWS::Region}.amazonaws.com:/ /${MountPoint}
02_permissions:
command: !Sub "chown ec2-user:ec2-user /${MountPoint}"
Properties:
AssociatePublicIpAddress: true
ImageId:
Fn::FindInMap:
- AWSRegionArch2AMI
- Ref: AWS::Region
- Fn::FindInMap:
- AWSInstanceType2Arch
- Ref: InstanceType
- Arch
InstanceType:
Ref: InstanceType
KeyName:
Ref: KeyName
SecurityGroups:
- Ref: InstanceSecurityGroup
IamInstanceProfile:
Ref: CloudWatchPutMetricsInstanceProfile
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
yum install -y aws-cfn-bootstrap
/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource LaunchConfiguration --configsets MountConfig --region ${AWS::Region}
crontab /home/ec2-user/crontab
/opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}
AutoScalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
DependsOn:
- MountTarget
- GatewayToInternet
CreationPolicy:
ResourceSignal:
Timeout: PT15M
Count:
Ref: AsgMaxSize
Properties:
VPCZoneIdentifier:
- Ref: Subnet
LaunchConfigurationName:
Ref: LaunchConfiguration
MinSize: '1'
MaxSize:
Ref: AsgMaxSize
DesiredCapacity:
Ref: AsgMaxSize
Tags:
- Key: Name
Value: EFS FileSystem Mounted Instance
PropagateAtLaunch: 'true'
Outputs:
MountTargetID:
Description: Mount target ID
Value:
Ref: MountTarget
FileSystemID:
Description: File system ID
Value:
Ref: FileSystem
```
# Cuplikan templat Elastic Beanstalk
Dengan Elastic Beanstalk, Anda dapat dengan cepat menyebarkan dan mengelola AWS aplikasi tanpa khawatir tentang infrastruktur yang menjalankan aplikasi tersebut. Contoh template berikut dapat membantu Anda menggambarkan sumber daya Elastic Beanstalk di template Anda. CloudFormation
## Contoh Elastic Beanstalk PHP
Contoh template berikut menyebarkan contoh aplikasi web PHP yang disimpan dalam bucket Amazon S3. Lingkungan ini juga merupakan lingkungan auto-scaling, load-balancing, dengan minimal dua instans EC2 Amazon dan maksimal enam. Ini menunjukkan lingkungan Elastic Beanstalk yang menggunakan konfigurasi peluncuran lama. Untuk selengkapnya tentang menggunakan templat peluncuran, lihat [Meluncurkan Template](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/environments-cfg-autoscaling-launch-templates.html) di *Panduan AWS Elastic Beanstalk Pengembang*.
Ganti `solution-stack` dengan nama tumpukan penyelesaian (versi platform). Untuk daftar tumpukan solusi yang tersedia, gunakan AWS CLI perintah**aws elasticbeanstalk list-available-solution-stacks**.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"sampleApplication": {
"Type": "AWS::ElasticBeanstalk::Application",
"Properties": {
"Description": "AWS Elastic Beanstalk Sample Application"
}
},
"sampleApplicationVersion": {
"Type": "AWS::ElasticBeanstalk::ApplicationVersion",
"Properties": {
"ApplicationName": {
"Ref": "sampleApplication"
},
"Description": "AWS ElasticBeanstalk Sample Application Version",
"SourceBundle": {
"S3Bucket": {
"Fn::Sub": "elasticbeanstalk-samples-${AWS::Region}"
},
"S3Key": "php-newsample-app.zip"
}
}
},
"sampleConfigurationTemplate": {
"Type": "AWS::ElasticBeanstalk::ConfigurationTemplate",
"Properties": {
"ApplicationName": {
"Ref": "sampleApplication"
},
"Description": "AWS ElasticBeanstalk Sample Configuration Template",
"OptionSettings": [
{
"Namespace": "aws:autoscaling:asg",
"OptionName": "MinSize",
"Value": "2"
},
{
"Namespace": "aws:autoscaling:asg",
"OptionName": "MaxSize",
"Value": "6"
},
{
"Namespace": "aws:elasticbeanstalk:environment",
"OptionName": "EnvironmentType",
"Value": "LoadBalanced"
},
{
"Namespace": "aws:autoscaling:launchconfiguration",
"OptionName": "IamInstanceProfile",
"Value": {
"Ref": "MyInstanceProfile"
}
}
],
"SolutionStackName": "solution-stack"
}
},
"sampleEnvironment": {
"Type": "AWS::ElasticBeanstalk::Environment",
"Properties": {
"ApplicationName": {
"Ref": "sampleApplication"
},
"Description": "AWS ElasticBeanstalk Sample Environment",
"TemplateName": {
"Ref": "sampleConfigurationTemplate"
},
"VersionLabel": {
"Ref": "sampleApplicationVersion"
}
}
},
"MyInstanceRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"ec2.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Description": "Beanstalk EC2 role",
"ManagedPolicyArns": [
"arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier",
"arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker",
"arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier"
]
}
},
"MyInstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Roles": [
{
"Ref": "MyInstanceRole"
}
]
}
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
sampleApplication:
Type: AWS::ElasticBeanstalk::Application
Properties:
Description: AWS Elastic Beanstalk Sample Application
sampleApplicationVersion:
Type: AWS::ElasticBeanstalk::ApplicationVersion
Properties:
ApplicationName:
Ref: sampleApplication
Description: AWS ElasticBeanstalk Sample Application Version
SourceBundle:
S3Bucket: !Sub "elasticbeanstalk-samples-${AWS::Region}"
S3Key: php-newsample-app.zip
sampleConfigurationTemplate:
Type: AWS::ElasticBeanstalk::ConfigurationTemplate
Properties:
ApplicationName:
Ref: sampleApplication
Description: AWS ElasticBeanstalk Sample Configuration Template
OptionSettings:
- Namespace: aws:autoscaling:asg
OptionName: MinSize
Value: '2'
- Namespace: aws:autoscaling:asg
OptionName: MaxSize
Value: '6'
- Namespace: aws:elasticbeanstalk:environment
OptionName: EnvironmentType
Value: LoadBalanced
- Namespace: aws:autoscaling:launchconfiguration
OptionName: IamInstanceProfile
Value: !Ref MyInstanceProfile
SolutionStackName: solution-stack
sampleEnvironment:
Type: AWS::ElasticBeanstalk::Environment
Properties:
ApplicationName:
Ref: sampleApplication
Description: AWS ElasticBeanstalk Sample Environment
TemplateName:
Ref: sampleConfigurationTemplate
VersionLabel:
Ref: sampleApplicationVersion
MyInstanceRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Description: Beanstalk EC2 role
ManagedPolicyArns:
- arn:aws:iam::aws:policy/AWSElasticBeanstalkWebTier
- arn:aws:iam::aws:policy/AWSElasticBeanstalkMulticontainerDocker
- arn:aws:iam::aws:policy/AWSElasticBeanstalkWorkerTier
MyInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Roles:
- !Ref MyInstanceRole
```
# Cuplikan templat Elastic Load Balancing
Untuk membuat Application Load Balancer, Network Load Balancer, atau Load Balancer Gateway, gunakan jenis sumber daya V2, yang dimulai dengan. `AWS::ElasticLoadBalancingV2` Untuk membuat Classic Load Balancer, gunakan jenis sumber daya yang dimulai dengan. `AWS::ElasticLoadBalancing`
**Topics**
+ [ELBv2 sumber daya](#scenario-elbv2-load-balancer)
+ [Sumber daya Classic Load Balancer](#scenario-elb-load-balancer)
## ELBv2 sumber daya
Contoh ini mendefinisikan Application Load Balancer dengan pendengar HTTP dan tindakan default yang meneruskan lalu lintas ke grup target. Penyeimbang beban menggunakan pengaturan pemeriksaan kesehatan default. Kelompok sasaran memiliki dua EC2 contoh terdaftar.
------
#### [ YAML ]
```
Resources:
myLoadBalancer:
Type: AWS::ElasticLoadBalancingV2::LoadBalancer
Properties:
Name: my-alb
Type: application
Scheme: internal
Subnets:
- !Ref subnet-AZ1
- !Ref subnet-AZ2
SecurityGroups:
- !Ref mySecurityGroup
myHTTPlistener:
Type: AWS::ElasticLoadBalancingV2::Listener
Properties:
LoadBalancerArn: !Ref myLoadBalancer
Protocol: HTTP
Port: 80
DefaultActions:
- Type: "forward"
TargetGroupArn: !Ref myTargetGroup
myTargetGroup:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
Name: "my-target-group"
Protocol: HTTP
Port: 80
TargetType: instance
VpcId: !Ref myVPC
Targets:
- Id: !GetAtt Instance1.InstanceId
Port: 80
- Id: !GetAtt Instance2.InstanceId
Port: 80
```
------
#### [ JSON ]
```
{
"Resources": {
"myLoadBalancer": {
"Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
"Properties": {
"Name": "my-alb",
"Type": "application",
"Scheme": "internal",
"Subnets": [
{
"Ref": "subnet-AZ1"
},
{
"Ref": "subnet-AZ2"
}
],
"SecurityGroups": [
{
"Ref": "mySecurityGroup"
}
]
}
},
"myHTTPlistener": {
"Type": "AWS::ElasticLoadBalancingV2::Listener",
"Properties": {
"LoadBalancerArn": {
"Ref": "myLoadBalancer"
},
"Protocol": "HTTP",
"Port": 80,
"DefaultActions": [
{
"Type": "forward",
"TargetGroupArn": {
"Ref": "myTargetGroup"
}
}
]
}
},
"myTargetGroup": {
"Type": "AWS::ElasticLoadBalancingV2::TargetGroup",
"Properties": {
"Name": "my-target-group",
"Protocol": "HTTP",
"Port": 80,
"TargetType": "instance",
"VpcId": {
"Ref": "myVPC"
},
"Targets": [
{
"Id": {
"Fn::GetAtt": [
"Instance1",
"InstanceId"
]
},
"Port": 80
},
{
"Id": {
"Fn::GetAtt": [
"Instance2",
"InstanceId"
]
},
"Port": 80
}
]
}
}
}
}
```
------
## Sumber daya Classic Load Balancer
Contoh ini mendefinisikan Classic Load Balancer dengan pendengar HTTP dan tidak ada instance terdaftar. EC2 Penyeimbang beban menggunakan pengaturan pemeriksaan kesehatan default.
------
#### [ YAML ]
```
myLoadBalancer:
Type: AWS::ElasticLoadBalancing::LoadBalancer
Properties:
AvailabilityZones:
- "us-east-1a"
Listeners:
- LoadBalancerPort: '80'
InstancePort: '80'
Protocol: HTTP
```
------
#### [ JSON ]
```
"myLoadBalancer" : {
"Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
"Properties" : {
"AvailabilityZones" : [ "us-east-1a" ],
"Listeners" : [ {
"LoadBalancerPort" : "80",
"InstancePort" : "80",
"Protocol" : "HTTP"
} ]
}
}
```
------
Contoh ini mendefinisikan Classic Load Balancer dengan pendengar HTTP, dua instance EC2 terdaftar, dan setelan pemeriksaan kesehatan khusus.
------
#### [ YAML ]
```
myClassicLoadBalancer:
Type: AWS::ElasticLoadBalancing::LoadBalancer
Properties:
AvailabilityZones:
- "us-east-1a"
Instances:
- Ref: Instance1
- Ref: Instance2
Listeners:
- LoadBalancerPort: '80'
InstancePort: '80'
Protocol: HTTP
HealthCheck:
Target: HTTP:80/
HealthyThreshold: '3'
UnhealthyThreshold: '5'
Interval: '30'
Timeout: '5'
```
------
#### [ JSON ]
```
"myClassicLoadBalancer" : {
"Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
"Properties" : {
"AvailabilityZones" : [ "us-east-1a" ],
"Instances" : [
{ "Ref" : "Instance1" },
{ "Ref" : "Instance2" }
],
"Listeners" : [ {
"LoadBalancerPort" : "80",
"InstancePort" : "80",
"Protocol" : "HTTP"
} ],
"HealthCheck" : {
"Target" : "HTTP:80/",
"HealthyThreshold" : "3",
"UnhealthyThreshold" : "5",
"Interval" : "30",
"Timeout" : "5"
}
}
}
```
------
# AWS Identity and Access Management cuplikan template
Bagian ini berisi cuplikan AWS Identity and Access Management template.
**Topics**
+ [Mendeklarasikan sumber daya pengguna IAM](#scenario-iam-user)
+ [Mendeklarasikan sumber daya kunci akses IAM](#scenario-iam-accesskey)
+ [Mendeklarasikan sumber daya grup IAM](#scenario-iam-group)
+ [Menambahkan pengguna ke grup](#scenario-iam-addusertogroup)
+ [Mendeklarasikan kebijakan IAM](#scenario-iam-policy)
+ [Mendeklarasikan kebijakan bucket Amazon S3](#scenario-bucket-policy)
+ [Mendeklarasikan kebijakan topik Amazon SNS](#scenario-sns-policy)
+ [Mendeklarasikan kebijakan Amazon SQS](#scenario-sqs-policy)
+ [Contoh templat IAM role](#scenarios-iamroles)
**penting**
Saat membuat atau memperbarui tumpukan menggunakan templat yang berisi sumber daya IAM, Anda harus mengakui penggunaan kemampuan IAM. Untuk informasi selengkapnya, lihat [Mengakui sumber daya IAM dalam templat CloudFormation](control-access-with-iam.md#using-iam-capabilities).
## Mendeklarasikan sumber daya pengguna IAM
Cuplikan ini menunjukkan cara mendeklarasikan sebuah sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) untuk membuat pengguna IAM. Pengguna dinyatakan dengan jalur (`"/"`) dan profil login dengan kata sandi (`myP@ssW0rd`).
Dokumen kebijakan bernama `giveaccesstoqueueonly` memberikan izin kepada pengguna untuk melakukan semua tindakan Amazon SQS pada sumber daya antrian Amazon SQS, dan menolak akses ke semua `myqueue` sumber daya antrian Amazon SQS lainnya. Fungsi `Fn::GetAtt` mengambil atribut Arn dari `myqueue` sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html).
Dokumen kebijakan bernama `giveaccesstotopiconly` ditambahkan ke pengguna untuk memberikan izin kepada pengguna untuk melakukan semua tindakan Amazon SNS pada `mytopic` sumber daya topik Amazon SNS dan untuk menolak akses ke semua sumber daya Amazon SNS lainnya. Fungsi `Ref` mengambil ARN dari `mytopic` sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html).
### JSON
```
"myuser" : {
"Type" : "AWS::IAM::User",
"Properties" : {
"Path" : "/",
"LoginProfile" : {
"Password" : "myP@ssW0rd"
},
"Policies" : [ {
"PolicyName" : "giveaccesstoqueueonly",
"PolicyDocument" : {
"Version": "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Action" : [ "sqs:*" ],
"Resource" : [ {
"Fn::GetAtt" : [ "myqueue", "Arn" ]
} ]
}, {
"Effect" : "Deny",
"Action" : [ "sqs:*" ],
"NotResource" : [ {
"Fn::GetAtt" : [ "myqueue", "Arn" ]
} ]
}
] }
}, {
"PolicyName" : "giveaccesstotopiconly",
"PolicyDocument" : {
"Version": "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Action" : [ "sns:*" ],
"Resource" : [ { "Ref" : "mytopic" } ]
}, {
"Effect" : "Deny",
"Action" : [ "sns:*" ],
"NotResource" : [ { "Ref" : "mytopic" } ]
} ]
}
} ]
}
}
```
### YAML
```
myuser:
Type: AWS::IAM::User
Properties:
Path: "/"
LoginProfile:
Password: myP@ssW0rd
Policies:
- PolicyName: giveaccesstoqueueonly
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sqs:*
Resource:
- !GetAtt myqueue.Arn
- Effect: Deny
Action:
- sqs:*
NotResource:
- !GetAtt myqueue.Arn
- PolicyName: giveaccesstotopiconly
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sns:*
Resource:
- !Ref mytopic
- Effect: Deny
Action:
- sns:*
NotResource:
- !Ref mytopic
```
## Mendeklarasikan sumber daya kunci akses IAM
###
Cuplikan ini menunjukkan sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-accesskey.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-accesskey.html). Sumber daya `myaccesskey` membuat access key dan menetapkannya ke pengguna IAM yang dinyatakan sebagai sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) dalam templat.
#### JSON
```
"myaccesskey" : {
"Type" : "AWS::IAM::AccessKey",
"Properties" : {
"UserName" : { "Ref" : "myuser" }
}
}
```
#### YAML
```
myaccesskey:
Type: AWS::IAM::AccessKey
Properties:
UserName:
!Ref myuser
```
###
Anda bisa mendapatkan kunci rahasia untuk sumber daya `AWS::IAM::AccessKey` menggunakan fungsi `Fn::GetAtt`. Salah satu cara untuk mengambil kunci rahasia adalah dengan memasukkannya ke dalam nilai `Output`. Anda bisa mendapatkan access key menggunakan fungsi `Ref`. Deklarasi nilai `Output` berikut mendapatkan access key dan kunci rahasia untuk `myaccesskey`.
#### JSON
```
"AccessKeyformyaccesskey" : {
"Value" : { "Ref" : "myaccesskey" }
},
"SecretKeyformyaccesskey" : {
"Value" : {
"Fn::GetAtt" : [ "myaccesskey", "SecretAccessKey" ]
}
}
```
#### YAML
```
AccessKeyformyaccesskey:
Value:
!Ref myaccesskey
SecretKeyformyaccesskey:
Value: !GetAtt myaccesskey.SecretAccessKey
```
###
Anda juga dapat meneruskan kunci AWS akses dan kunci rahasia ke EC2 instans Amazon atau grup Auto Scaling yang ditentukan dalam template. Deklarasi berikut [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) menggunakan properti `UserData` untuk meneruskan access key dan kunci rahasia untuk sumber daya `myaccesskey`.
#### JSON
```
"myinstance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"AvailabilityZone" : "us-east-1a",
"ImageId" : "ami-0ff8a91507f77f867",
"UserData" : {
"Fn::Base64" : {
"Fn::Join" : [
"", [
"ACCESS_KEY=", {
"Ref" : "myaccesskey"
},
"&",
"SECRET_KEY=",
{
"Fn::GetAtt" : [
"myaccesskey",
"SecretAccessKey"
]
}
]
]
}
}
}
}
```
#### YAML
```
myinstance:
Type: AWS::EC2::Instance
Properties:
AvailabilityZone: "us-east-1a"
ImageId: ami-0ff8a91507f77f867
UserData:
Fn::Base64: !Sub "ACCESS_KEY=${myaccesskey}&SECRET_KEY=${myaccesskey.SecretAccessKey}"
```
## Mendeklarasikan sumber daya grup IAM
Cuplikan ini menunjukkan sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html). Grup ini memiliki jalur (`"/myapplication/"`). Dokumen kebijakan bernama `myapppolicy` ditambahkan ke grup untuk memungkinkan pengguna grup melakukan semua tindakan Amazon SQS pada myqueue sumber daya antrian Amazon SQS dan menolak akses ke semua resource Amazon SQS lainnya kecuali. `myqueue`
Untuk menetapkan kebijakan pada sumber daya, IAM memerlukan Amazon Resource Name (ARN) untuk sumber daya tersebut. Dalam cuplikan, fungsi `Fn::GetAtt` mendapat ARN dari antrean sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html).
### JSON
```
"mygroup" : {
"Type" : "AWS::IAM::Group",
"Properties" : {
"Path" : "/myapplication/",
"Policies" : [ {
"PolicyName" : "myapppolicy",
"PolicyDocument" : {
"Version": "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Action" : [ "sqs:*" ],
"Resource" : [ {
"Fn::GetAtt" : [ "myqueue", "Arn" ]
} ]
},
{
"Effect" : "Deny",
"Action" : [ "sqs:*" ],
"NotResource" : [ { "Fn::GetAtt" : [ "myqueue", "Arn" ] } ]
}
] }
} ]
}
}
```
### YAML
```
mygroup:
Type: AWS::IAM::Group
Properties:
Path: "/myapplication/"
Policies:
- PolicyName: myapppolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- sqs:*
Resource: !GetAtt myqueue.Arn
- Effect: Deny
Action:
- sqs:*
NotResource: !GetAtt myqueue.Arn
```
## Menambahkan pengguna ke grup
Sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-usertogroupaddition.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-usertogroupaddition.html) menambahkan pengguna ke grup. Pada potongan berikut, sumber daya `addUserToGroup` menambahkan pengguna berikut ke grup yang ada bernama `myexistinggroup2`: pengguna yang ada `existinguser1` dan pengguna `myuser` yang dinyatakan sebagai sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) dalam templat.
### JSON
```
"addUserToGroup" : {
"Type" : "AWS::IAM::UserToGroupAddition",
"Properties" : {
"GroupName" : "myexistinggroup2",
"Users" : [ "existinguser1", { "Ref" : "myuser" } ]
}
}
```
### YAML
```
addUserToGroup:
Type: AWS::IAM::UserToGroupAddition
Properties:
GroupName: myexistinggroup2
Users:
- existinguser1
- !Ref myuser
```
## Mendeklarasikan kebijakan IAM
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke beberapa grup menggunakan sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-policy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-policy.html) bernama `mypolicy`. Sumber daya `mypolicy` berisi properti `PolicyDocument` yang memungkinkan tindakan `GetObject`, `PutObject`, dan `PutObjectAcl` pada objek dalam bucket S3 yang diwakili oleh `arn:aws:s3:::myAWSBucket` ARN. `mypolicy`Sumber daya menerapkan kebijakan ke grup yang ada bernama `myexistinggroup1` dan grup `mygroup` yang dideklarasikan dalam templat sebagai [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html)sumber daya. Contoh ini menunjukkan cara menerapkan kebijakan ke grup yang menggunakan properti `Groups`; Namun, Anda juga dapat menggunakan properti `Users` untuk menambahkan dokumen kebijakan ke daftar pengguna.
### JSON
```
"mypolicy" : {
"Type" : "AWS::IAM::Policy",
"Properties" : {
"PolicyName" : "mygrouppolicy",
"PolicyDocument" : {
"Version": "2012-10-17",
"Statement" : [ {
"Effect" : "Allow",
"Action" : [
"s3:GetObject" , "s3:PutObject" , "s3:PutObjectAcl" ],
"Resource" : "arn:aws:s3:::myAWSBucket/*"
} ]
},
"Groups" : [ "myexistinggroup1", { "Ref" : "mygroup" } ]
}
}
```
### YAML
```
mypolicy:
Type: AWS::IAM::Policy
Properties:
PolicyName: mygrouppolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- s3:GetObject
- s3:PutObject
- s3:PutObjectAcl
Resource: arn:aws:s3:::myAWSBucket/*
Groups:
- myexistinggroup1
- !Ref mygroup
```
## Mendeklarasikan kebijakan bucket Amazon S3
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke bucket Amazon S3 menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-s3-bucket.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-s3-bucket.html) `mybucketpolicy`Sumber daya mendeklarasikan dokumen kebijakan yang memungkinkan pengguna `user1` IAM untuk melakukan `GetObject` tindakan pada semua objek dalam bucket S3 tempat kebijakan ini diterapkan. Dalam cuplikan, fungsi `Fn::GetAtt` mengambil ARN dari sumber daya `user1`. Sumber daya `mybucketpolicy` menerapkan kebijakan untuk my bucket sumber daya `AWS::S3::BucketPolicy`. Fungsi `Ref` mengambil nama bucket dari sumber daya `mybucket`.
### JSON
```
"mybucketpolicy" : {
"Type" : "AWS::S3::BucketPolicy",
"Properties" : {
"PolicyDocument" : {
"Id" : "MyPolicy",
"Version": "2012-10-17",
"Statement" : [ {
"Sid" : "ReadAccess",
"Action" : [ "s3:GetObject" ],
"Effect" : "Allow",
"Resource" : { "Fn::Join" : [
"", [ "arn:aws:s3:::", { "Ref" : "mybucket" } , "/*" ]
] },
"Principal" : {
"AWS" : { "Fn::GetAtt" : [ "user1", "Arn" ] }
}
} ]
},
"Bucket" : { "Ref" : "mybucket" }
}
}
```
### YAML
```
mybucketpolicy:
Type: AWS::S3::BucketPolicy
Properties:
PolicyDocument:
Id: MyPolicy
Version: '2012-10-17'
Statement:
- Sid: ReadAccess
Action:
- s3:GetObject
Effect: Allow
Resource: !Sub "arn:aws:s3:::${mybucket}/*"
Principal:
AWS: !GetAtt user1.Arn
Bucket: !Ref mybucket
```
## Mendeklarasikan kebijakan topik Amazon SNS
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke topik Amazon SNS menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topicpolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topicpolicy.html) Sumber daya `mysnspolicy` berisi properti `PolicyDocument` yang memungkinkan `myuser` sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) untuk melakukan tindakan `Publish` pada `mytopic` sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html). Dalam cuplikan, fungsi `Fn::GetAtt` mendapat ARN untuk sumber daya `myuser` dan fungsi `Ref` mendapat ARN untuk sumber daya `mytopic`.
### JSON
```
"mysnspolicy" : {
"Type" : "AWS::SNS::TopicPolicy",
"Properties" : {
"PolicyDocument" : {
"Id" : "MyTopicPolicy",
"Version": "2012-10-17",
"Statement" : [ {
"Sid" : "My-statement-id",
"Effect" : "Allow",
"Principal" : {
"AWS" : { "Fn::GetAtt" : [ "myuser", "Arn" ] }
},
"Action" : "sns:Publish",
"Resource" : "*"
} ]
},
"Topics" : [ { "Ref" : "mytopic" } ]
}
}
```
### YAML
```
mysnspolicy:
Type: AWS::SNS::TopicPolicy
Properties:
PolicyDocument:
Id: MyTopicPolicy
Version: '2012-10-17'
Statement:
- Sid: My-statement-id
Effect: Allow
Principal:
AWS: !GetAtt myuser.Arn
Action: sns:Publish
Resource: "*"
Topics:
- !Ref mytopic
```
## Mendeklarasikan kebijakan Amazon SQS
Cuplikan ini menunjukkan cara membuat kebijakan dan menerapkannya ke antrian Amazon SQS menggunakan sumber daya. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queuepolicy.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queuepolicy.html) Properti `PolicyDocument` memungkinkan pengguna yang ada `myapp` (ditentukan oleh ARN nya) untuk melakukan tindakan `SendMessage` pada antrian yang sudah ada, yang ditentukan oleh URL-nya, dan myqueue sumber daya [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sqs-queue.html). Fungsi [Ref](resources-section-structure.md#resource-properties-ref) mendapat URL untuk sumber daya `myqueue`.
### JSON
```
"mysqspolicy" : {
"Type" : "AWS::SQS::QueuePolicy",
"Properties" : {
"PolicyDocument" : {
"Id" : "MyQueuePolicy",
"Version": "2012-10-17",
"Statement" : [ {
"Sid" : "Allow-User-SendMessage",
"Effect" : "Allow",
"Principal" : {
"AWS" : "arn:aws:iam::123456789012:user/myapp"
},
"Action" : [ "sqs:SendMessage" ],
"Resource" : "*"
} ]
},
"Queues" : [
"https://sqs.us-east-2aws-region.amazonaws.com/123456789012/myexistingqueue",
{ "Ref" : "myqueue" }
]
}
}
```
### YAML
```
mysqspolicy:
Type: AWS::SQS::QueuePolicy
Properties:
PolicyDocument:
Id: MyQueuePolicy
Version: '2012-10-17'
Statement:
- Sid: Allow-User-SendMessage
Effect: Allow
Principal:
AWS: arn:aws:iam::123456789012:user/myapp
Action:
- sqs:SendMessage
Resource: "*"
Queues:
- https://sqs.aws-region.amazonaws.com/123456789012/myexistingqueue
- !Ref myqueue
```
## Contoh templat IAM role
Bagian ini memberikan contoh CloudFormation template untuk peran IAM untuk EC2 instance.
Untuk informasi selengkapnya, lihat [peran IAM untuk Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) di *Panduan EC2 Pengguna Amazon*.
### Peran IAM dengan EC2
Dalam contoh ini, profil instance direferensikan oleh `IamInstanceProfile` properti EC2 instance. Kebijakan instans dan referensi kebijakan peran [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html).
#### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"myEC2Instance": {
"Type": "AWS::EC2::Instance",
"Version": "2009-05-15",
"Properties": {
"ImageId": "ami-0ff8a91507f77f867",
"InstanceType": "m1.small",
"Monitoring": "true",
"DisableApiTermination": "false",
"IamInstanceProfile": {
"Ref": "RootInstanceProfile"
}
}
},
"RootRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [ {
"Effect": "Allow",
"Principal": {
"Service": [ "ec2.amazonaws.com" ]
},
"Action": [ "sts:AssumeRole" ]
} ]
},
"Path": "/"
}
},
"RolePolicies": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [ {
"Effect": "Allow",
"Action": "*",
"Resource": "*"
} ]
},
"Roles": [ { "Ref": "RootRole" } ]
}
},
"RootInstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [ { "Ref": "RootRole" } ]
}
}
}
}
```
#### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
myEC2Instance:
Type: AWS::EC2::Instance
Version: '2009-05-15'
Properties:
ImageId: ami-0ff8a91507f77f867
InstanceType: m1.small
Monitoring: 'true'
DisableApiTermination: 'false'
IamInstanceProfile:
!Ref RootInstanceProfile
RootRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
RolePolicies:
Type: AWS::IAM::Policy
Properties:
PolicyName: root
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action: "*"
Resource: "*"
Roles:
- !Ref RootRole
RootInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: "/"
Roles:
- !Ref RootRole
```
### Peran IAM dengan grup Auto Scaling
Dalam contoh ini, profil instance direferensikan oleh `IamInstanceProfile` properti konfigurasi peluncuran Amazon EC2 Auto Scaling.
#### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Resources": {
"myLCOne": {
"Type": "AWS::AutoScaling::LaunchConfiguration",
"Version": "2009-05-15",
"Properties": {
"ImageId": "ami-0ff8a91507f77f867",
"InstanceType": "m1.small",
"InstanceMonitoring": "true",
"IamInstanceProfile": { "Ref": "RootInstanceProfile" }
}
},
"myASGrpOne": {
"Type": "AWS::AutoScaling::AutoScalingGroup",
"Version": "2009-05-15",
"Properties": {
"AvailabilityZones": [ "us-east-1a" ],
"LaunchConfigurationName": { "Ref": "myLCOne" },
"MinSize": "0",
"MaxSize": "0",
"HealthCheckType": "EC2",
"HealthCheckGracePeriod": "120"
}
},
"RootRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [ {
"Effect": "Allow",
"Principal": {
"Service": [ "ec2.amazonaws.com" ]
},
"Action": [ "sts:AssumeRole" ]
} ]
},
"Path": "/"
}
},
"RolePolicies": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [ {
"Effect": "Allow",
"Action": "*",
"Resource": "*"
} ]
},
"Roles": [ { "Ref": "RootRole" } ]
}
},
"RootInstanceProfile": {
"Type": "AWS::IAM::InstanceProfile",
"Properties": {
"Path": "/",
"Roles": [ { "Ref": "RootRole" } ]
}
}
}
}
```
#### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
myLCOne:
Type: AWS::AutoScaling::LaunchConfiguration
Version: '2009-05-15'
Properties:
ImageId: ami-0ff8a91507f77f867
InstanceType: m1.small
InstanceMonitoring: 'true'
IamInstanceProfile:
!Ref RootInstanceProfile
myASGrpOne:
Type: AWS::AutoScaling::AutoScalingGroup
Version: '2009-05-15'
Properties:
AvailabilityZones:
- "us-east-1a"
LaunchConfigurationName:
!Ref myLCOne
MinSize: '0'
MaxSize: '0'
HealthCheckType: EC2
HealthCheckGracePeriod: '120'
RootRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- ec2.amazonaws.com
Action:
- sts:AssumeRole
Path: "/"
RolePolicies:
Type: AWS::IAM::Policy
Properties:
PolicyName: root
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action: "*"
Resource: "*"
Roles:
- !Ref RootRole
RootInstanceProfile:
Type: AWS::IAM::InstanceProfile
Properties:
Path: "/"
Roles:
- !Ref RootRole
```
# AWS Lambda Template
Template berikut menggunakan fungsi AWS Lambda (Lambda) dan sumber daya khusus untuk menambahkan grup keamanan baru ke daftar grup keamanan yang ada. Fungsi ini berguna ketika Anda ingin membangun daftar grup keamanan secara dinamis, sehingga daftar Anda mencakup grup keamanan baru dan yang sudah ada. Misalnya, Anda dapat meneruskan daftar grup keamanan yang ada sebagai nilai parameter, menambahkan nilai baru ke daftar, dan kemudian mengaitkan semua nilai Anda dengan sebuah EC2 instance. Untuk informasi selengkapnya tentang jenis sumber daya fungsi Lambda, lihat. [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-lambda-function.html)
Dalam contoh, saat CloudFormation membuat sumber daya `AllSecurityGroups` khusus, CloudFormation memanggil fungsi `AppendItemToListFunction` Lambda. CloudFormation meneruskan daftar grup keamanan yang ada dan grup keamanan baru (`NewSecurityGroup`) ke fungsi, yang menambahkan grup keamanan baru ke daftar dan kemudian mengembalikan daftar yang dimodifikasi. CloudFormation menggunakan daftar yang dimodifikasi untuk mengaitkan semua grup keamanan dengan `MyEC2Instance` sumber daya.
## JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters": {
"ExistingSecurityGroups": {
"Type": "List"
},
"ExistingVPC": {
"Type": "AWS::EC2::VPC::Id",
"Description": "The VPC ID that includes the security groups in the ExistingSecurityGroups parameter."
},
"InstanceType": {
"Type": "String",
"Default": "t2.micro",
"AllowedValues": [
"t2.micro",
"t3.micro"
]
}
},
"Resources": {
"SecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Allow HTTP traffic to the host",
"VpcId": {
"Ref": "ExistingVPC"
},
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
],
"SecurityGroupEgress": [
{
"IpProtocol": "tcp",
"FromPort": 80,
"ToPort": 80,
"CidrIp": "0.0.0.0/0"
}
]
}
},
"AllSecurityGroups": {
"Type": "Custom::Split",
"Properties": {
"ServiceToken": {
"Fn::GetAtt": [
"AppendItemToListFunction",
"Arn"
]
},
"List": {
"Ref": "ExistingSecurityGroups"
},
"AppendedItem": {
"Ref": "SecurityGroup"
}
}
},
"AppendItemToListFunction": {
"Type": "AWS::Lambda::Function",
"Properties": {
"Handler": "index.handler",
"Role": {
"Fn::GetAtt": [
"LambdaExecutionRole",
"Arn"
]
},
"Code": {
"ZipFile": {
"Fn::Join": [
"",
[
"var response = require('cfn-response');",
"exports.handler = function(event, context) {",
" var responseData = {Value: event.ResourceProperties.List};",
" responseData.Value.push(event.ResourceProperties.AppendedItem);",
" response.send(event, context, response.SUCCESS, responseData);",
"};"
]
]
}
},
"Runtime": "nodejs20.x"
}
},
"MyEC2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}",
"SecurityGroupIds": {
"Fn::GetAtt": [
"AllSecurityGroups",
"Value"
]
},
"InstanceType": {
"Ref": "InstanceType"
}
}
},
"LambdaExecutionRole": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": [
"lambda.amazonaws.com"
]
},
"Action": [
"sts:AssumeRole"
]
}
]
},
"Path": "/",
"Policies": [
{
"PolicyName": "root",
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "arn:aws:logs:*:*:*"
}
]
}
}
]
}
}
},
"Outputs": {
"AllSecurityGroups": {
"Description": "Security Groups that are associated with the EC2 instance",
"Value": {
"Fn::Join": [
", ",
{
"Fn::GetAtt": [
"AllSecurityGroups",
"Value"
]
}
]
}
}
}
}
```
## YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
ExistingSecurityGroups:
Type: List
ExistingVPC:
Type: AWS::EC2::VPC::Id
Description: The VPC ID that includes the security groups in the ExistingSecurityGroups parameter.
InstanceType:
Type: String
Default: t2.micro
AllowedValues:
- t2.micro
- t3.micro
Resources:
SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Allow HTTP traffic to the host
VpcId: !Ref ExistingVPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
AllSecurityGroups:
Type: Custom::Split
Properties:
ServiceToken: !GetAtt AppendItemToListFunction.Arn
List: !Ref ExistingSecurityGroups
AppendedItem: !Ref SecurityGroup
AppendItemToListFunction:
Type: AWS::Lambda::Function
Properties:
Handler: index.handler
Role: !GetAtt LambdaExecutionRole.Arn
Code:
ZipFile: !Join
- ''
- - var response = require('cfn-response');
- exports.handler = function(event, context) {
- ' var responseData = {Value: event.ResourceProperties.List};'
- ' responseData.Value.push(event.ResourceProperties.AppendedItem);'
- ' response.send(event, context, response.SUCCESS, responseData);'
- '};'
Runtime: nodejs20.x
MyEC2Instance:
Type: AWS::EC2::Instance
Properties:
ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
SecurityGroupIds: !GetAtt AllSecurityGroups.Value
InstanceType: !Ref InstanceType
LambdaExecutionRole:
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- lambda.amazonaws.com
Action:
- sts:AssumeRole
Path: /
Policies:
- PolicyName: root
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- logs:*
Resource: arn:aws:logs:*:*:*
Outputs:
AllSecurityGroups:
Description: Security Groups that are associated with the EC2 instance
Value: !Join
- ', '
- !GetAtt AllSecurityGroups.Value
```
# Cuplikan template Amazon Redshift
Amazon Redshift adalah layanan gudang data dengan skala petabyte yang terkelola penuh di cloud. Anda dapat menggunakan CloudFormation untuk menyediakan dan mengelola klaster Amazon Redshift.
## Klaster Amazon Redshift
Contoh template berikut membuat klaster Amazon Redshift sesuai dengan nilai parameter yang ditentukan saat tumpukan dibuat. Grup parameter cluster yang dikaitkan dengan cluster Amazon Redshift memungkinkan pencatatan aktivitas pengguna. Template ini juga meluncurkan cluster Amazon Redshift di VPC Amazon yang ditentukan dalam template. VPC menyertakan gateway internet sehingga Anda dapat mengakses kluster Amazon Redshift dari Internet. Namun, komunikasi antara klaster dan gateway Internet juga harus diaktifkan, yang dilakukan oleh entri tabel rute.
**catatan**
Templat mencakup kondisi `IsMultiNodeCluster` sehingga parameter `NumberOfNodes` dinyatakan hanya ketika nilai parameter `ClusterType` diatur ke `multi-node`.
Contoh mendefinisikan parameter `MysqlRootPassword` dengan properti `NoEcho` diatur menjadi `true`. Jika Anda mengatur atribut `NoEcho` menjadi `true`, CloudFormation mengembalikan nilai parameter tertutup sebagai tanda bintang (\$1\$1\$1\$1\$1) untuk setiap panggilan yang menggambarkan tumpukan atau peristiwa tumpukan, kecuali untuk informasi yang disimpan di lokasi yang ditentukan di bawah ini.
**penting**
Menggunakan `NoEcho` atribut tidak menutupi informasi apa pun yang disimpan sebagai berikut:
Bagian `Metadata` template. CloudFormation tidak mengubah, memodifikasi, atau menyunting informasi apa pun yang Anda sertakan di `Metadata` bagian ini. Untuk informasi selengkapnya, lihat [Metadata](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html).
Bagian `Outputs` template. Untuk informasi selengkapnya, lihat [Output](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html).
`Metadata`Atribut definisi sumber daya. Untuk informasi lebih lanjut, lihat [Atribut `Metadata`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-metadata.html).
Kami sangat menyarankan Anda untuk tidak menggunakan mekanisme ini untuk memasukkan informasi sensitif, seperti kata sandi atau rahasia.
**penting**
Daripada menyematkan informasi sensitif secara langsung di CloudFormation template Anda, kami sarankan Anda menggunakan parameter dinamis dalam template tumpukan untuk mereferensikan informasi sensitif yang disimpan dan dikelola di luar CloudFormation, seperti di AWS Systems Manager Parameter Store atau AWS Secrets Manager.
Untuk informasi selengkapnya, lihat Do [not embed credentials dalam praktik terbaik template Anda](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-best-practices.html#creds).
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Parameters" : {
"DatabaseName" : {
"Description" : "The name of the first database to be created when the cluster is created",
"Type" : "String",
"Default" : "dev",
"AllowedPattern" : "([a-z]|[0-9])+"
},
"ClusterType" : {
"Description" : "The type of cluster",
"Type" : "String",
"Default" : "single-node",
"AllowedValues" : [ "single-node", "multi-node" ]
},
"NumberOfNodes" : {
"Description" : "The number of compute nodes in the cluster. For multi-node clusters, the NumberOfNodes parameter must be greater than 1",
"Type" : "Number",
"Default" : "1"
},
"NodeType" : {
"Description" : "The type of node to be provisioned",
"Type" : "String",
"Default" : "ds2.xlarge",
"AllowedValues" : [ "ds2.xlarge", "ds2.8xlarge", "dc1.large", "dc1.8xlarge" ]
},
"MasterUsername" : {
"Description" : "The user name that is associated with the master user account for the cluster that is being created",
"Type" : "String",
"Default" : "defaultuser",
"AllowedPattern" : "([a-z])([a-z]|[0-9])*"
},
"MasterUserPassword" : {
"Description" : "The password that is associated with the master user account for the cluster that is being created.",
"Type" : "String",
"NoEcho" : "true"
},
"InboundTraffic" : {
"Description" : "Allow inbound traffic to the cluster from this CIDR range.",
"Type" : "String",
"MinLength": "9",
"MaxLength": "18",
"Default" : "0.0.0.0/0",
"AllowedPattern" : "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
"ConstraintDescription" : "must be a valid CIDR range of the form x.x.x.x/x."
},
"PortNumber" : {
"Description" : "The port number on which the cluster accepts incoming connections.",
"Type" : "Number",
"Default" : "5439"
}
},
"Conditions" : {
"IsMultiNodeCluster" : {
"Fn::Equals" : [{ "Ref" : "ClusterType" }, "multi-node" ]
}
},
"Resources" : {
"RedshiftCluster" : {
"Type" : "AWS::Redshift::Cluster",
"DependsOn" : "AttachGateway",
"Properties" : {
"ClusterType" : { "Ref" : "ClusterType" },
"NumberOfNodes" : { "Fn::If" : [ "IsMultiNodeCluster", { "Ref" : "NumberOfNodes" }, { "Ref" : "AWS::NoValue" }]},
"NodeType" : { "Ref" : "NodeType" },
"DBName" : { "Ref" : "DatabaseName" },
"MasterUsername" : { "Ref" : "MasterUsername" },
"MasterUserPassword" : { "Ref" : "MasterUserPassword" },
"ClusterParameterGroupName" : { "Ref" : "RedshiftClusterParameterGroup" },
"VpcSecurityGroupIds" : [ { "Ref" : "SecurityGroup" } ],
"ClusterSubnetGroupName" : { "Ref" : "RedshiftClusterSubnetGroup" },
"PubliclyAccessible" : "true",
"Port" : { "Ref" : "PortNumber" }
}
},
"RedshiftClusterParameterGroup" : {
"Type" : "AWS::Redshift::ClusterParameterGroup",
"Properties" : {
"Description" : "Cluster parameter group",
"ParameterGroupFamily" : "redshift-1.0",
"Parameters" : [{
"ParameterName" : "enable_user_activity_logging",
"ParameterValue" : "true"
}]
}
},
"RedshiftClusterSubnetGroup" : {
"Type" : "AWS::Redshift::ClusterSubnetGroup",
"Properties" : {
"Description" : "Cluster subnet group",
"SubnetIds" : [ { "Ref" : "PublicSubnet" } ]
}
},
"VPC" : {
"Type" : "AWS::EC2::VPC",
"Properties" : {
"CidrBlock" : "10.0.0.0/16"
}
},
"PublicSubnet" : {
"Type" : "AWS::EC2::Subnet",
"Properties" : {
"CidrBlock" : "10.0.0.0/24",
"VpcId" : { "Ref" : "VPC" }
}
},
"SecurityGroup" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Security group",
"SecurityGroupIngress" : [ {
"CidrIp" : { "Ref": "InboundTraffic" },
"FromPort" : { "Ref" : "PortNumber" },
"ToPort" : { "Ref" : "PortNumber" },
"IpProtocol" : "tcp"
} ],
"VpcId" : { "Ref" : "VPC" }
}
},
"myInternetGateway" : {
"Type" : "AWS::EC2::InternetGateway"
},
"AttachGateway" : {
"Type" : "AWS::EC2::VPCGatewayAttachment",
"Properties" : {
"VpcId" : { "Ref" : "VPC" },
"InternetGatewayId" : { "Ref" : "myInternetGateway" }
}
},
"PublicRouteTable" : {
"Type" : "AWS::EC2::RouteTable",
"Properties" : {
"VpcId" : {
"Ref" : "VPC"
}
}
},
"PublicRoute" : {
"Type" : "AWS::EC2::Route",
"DependsOn" : "AttachGateway",
"Properties" : {
"RouteTableId" : {
"Ref" : "PublicRouteTable"
},
"DestinationCidrBlock" : "0.0.0.0/0",
"GatewayId" : {
"Ref" : "myInternetGateway"
}
}
},
"PublicSubnetRouteTableAssociation" : {
"Type" : "AWS::EC2::SubnetRouteTableAssociation",
"Properties" : {
"SubnetId" : {
"Ref" : "PublicSubnet"
},
"RouteTableId" : {
"Ref" : "PublicRouteTable"
}
}
}
},
"Outputs" : {
"ClusterEndpoint" : {
"Description" : "Cluster endpoint",
"Value" : { "Fn::Join" : [ ":", [ { "Fn::GetAtt" : [ "RedshiftCluster", "Endpoint.Address" ] }, { "Fn::GetAtt" : [ "RedshiftCluster", "Endpoint.Port" ] } ] ] }
},
"ClusterName" : {
"Description" : "Name of cluster",
"Value" : { "Ref" : "RedshiftCluster" }
},
"ParameterGroupName" : {
"Description" : "Name of parameter group",
"Value" : { "Ref" : "RedshiftClusterParameterGroup" }
},
"RedshiftClusterSubnetGroupName" : {
"Description" : "Name of cluster subnet group",
"Value" : { "Ref" : "RedshiftClusterSubnetGroup" }
},
"RedshiftClusterSecurityGroupName" : {
"Description" : "Name of cluster security group",
"Value" : { "Ref" : "SecurityGroup" }
}
}
}
```
### YAML
```
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
DatabaseName:
Description: The name of the first database to be created when the cluster is
created
Type: String
Default: dev
AllowedPattern: "([a-z]|[0-9])+"
ClusterType:
Description: The type of cluster
Type: String
Default: single-node
AllowedValues:
- single-node
- multi-node
NumberOfNodes:
Description: The number of compute nodes in the cluster. For multi-node clusters,
the NumberOfNodes parameter must be greater than 1
Type: Number
Default: '1'
NodeType:
Description: The type of node to be provisioned
Type: String
Default: ds2.xlarge
AllowedValues:
- ds2.xlarge
- ds2.8xlarge
- dc1.large
- dc1.8xlarge
MasterUsername:
Description: The user name that is associated with the master user account for
the cluster that is being created
Type: String
Default: defaultuser
AllowedPattern: "([a-z])([a-z]|[0-9])*"
MasterUserPassword:
Description: The password that is associated with the master user account for
the cluster that is being created.
Type: String
NoEcho: 'true'
InboundTraffic:
Description: Allow inbound traffic to the cluster from this CIDR range.
Type: String
MinLength: '9'
MaxLength: '18'
Default: 0.0.0.0/0
AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
ConstraintDescription: must be a valid CIDR range of the form x.x.x.x/x.
PortNumber:
Description: The port number on which the cluster accepts incoming connections.
Type: Number
Default: '5439'
Conditions:
IsMultiNodeCluster:
Fn::Equals:
- Ref: ClusterType
- multi-node
Resources:
RedshiftCluster:
Type: AWS::Redshift::Cluster
DependsOn: AttachGateway
Properties:
ClusterType:
Ref: ClusterType
NumberOfNodes:
Fn::If:
- IsMultiNodeCluster
- Ref: NumberOfNodes
- Ref: AWS::NoValue
NodeType:
Ref: NodeType
DBName:
Ref: DatabaseName
MasterUsername:
Ref: MasterUsername
MasterUserPassword:
Ref: MasterUserPassword
ClusterParameterGroupName:
Ref: RedshiftClusterParameterGroup
VpcSecurityGroupIds:
- Ref: SecurityGroup
ClusterSubnetGroupName:
Ref: RedshiftClusterSubnetGroup
PubliclyAccessible: 'true'
Port:
Ref: PortNumber
RedshiftClusterParameterGroup:
Type: AWS::Redshift::ClusterParameterGroup
Properties:
Description: Cluster parameter group
ParameterGroupFamily: redshift-1.0
Parameters:
- ParameterName: enable_user_activity_logging
ParameterValue: 'true'
RedshiftClusterSubnetGroup:
Type: AWS::Redshift::ClusterSubnetGroup
Properties:
Description: Cluster subnet group
SubnetIds:
- Ref: PublicSubnet
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
PublicSubnet:
Type: AWS::EC2::Subnet
Properties:
CidrBlock: 10.0.0.0/24
VpcId:
Ref: VPC
SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Security group
SecurityGroupIngress:
- CidrIp:
Ref: InboundTraffic
FromPort:
Ref: PortNumber
ToPort:
Ref: PortNumber
IpProtocol: tcp
VpcId:
Ref: VPC
myInternetGateway:
Type: AWS::EC2::InternetGateway
AttachGateway:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId:
Ref: VPC
InternetGatewayId:
Ref: myInternetGateway
PublicRouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: VPC
PublicRoute:
Type: AWS::EC2::Route
DependsOn: AttachGateway
Properties:
RouteTableId:
Ref: PublicRouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId:
Ref: myInternetGateway
PublicSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId:
Ref: PublicSubnet
RouteTableId:
Ref: PublicRouteTable
Outputs:
ClusterEndpoint:
Description: Cluster endpoint
Value: !Sub "${RedshiftCluster.Endpoint.Address}:${RedshiftCluster.Endpoint.Port}"
ClusterName:
Description: Name of cluster
Value:
Ref: RedshiftCluster
ParameterGroupName:
Description: Name of parameter group
Value:
Ref: RedshiftClusterParameterGroup
RedshiftClusterSubnetGroupName:
Description: Name of cluster subnet group
Value:
Ref: RedshiftClusterSubnetGroup
RedshiftClusterSecurityGroupName:
Description: Name of cluster security group
Value:
Ref: SecurityGroup
```
## Lihat juga
[AWS::Redshift::Cluster](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-redshift-cluster.html)
# Cuplikan template Amazon RDS
**Topics**
+ [Sumber daya instans Amazon RDS DB](#scenario-rds-instance)
+ [Sumber daya instans DB database oracle Amazon RDS](#scenario-rds-oracleinstance)
+ [Sumber daya Amazon RDS DBSecurity Group untuk rentang CIDR](#scenario-rds-security-group-cidr)
+ [Amazon RDS DBSecurity Group dengan grup EC2 keamanan Amazon](#scenario-rds-security-group-ec2)
+ [Beberapa grup keamanan VPC](#scenario-multiple-vpc-security-groups)
+ [Instans database Amazon RDS dalam grup keamanan VPC](#w2aac11c41c76c15)
## Sumber daya instans Amazon RDS DB
Contoh ini menunjukkan sumber daya Instans Amazon RDS DB dengan kata sandi pengguna master terkelola. Untuk informasi selengkapnya, lihat [Manajemen kata sandi dengan AWS Secrets Manager](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html) di *Panduan Pengguna Amazon RDS* dan [Manajemen Kata AWS Secrets Manager Sandi](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/rds-secrets-manager.html) di Panduan Pengguna *Aurora*. Karena `EngineVersion` properti opsional tidak ditentukan, versi mesin default digunakan untuk Instans DB ini. Untuk detail tentang versi mesin default dan setelan default lainnya, lihat [Membuat DBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html). `DBSecurityGroups`Properti mengotorisasi masuknya jaringan ke `AWS::RDS::DBSecurityGroup` sumber daya bernama `MyDbSecurityByEC2SecurityGroup` dan. MyDbSecurityBy CIDRIPGroup Lihat perinciannya di [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html). Sumber daya Instans DB juga memiliki `DeletionPolicy` atribut yang disetel ke`Snapshot`. Dengan `Snapshot` `DeletionPolicy` set, CloudFormation akan mengambil snapshot dari Instans DB ini sebelum menghapusnya selama penghapusan tumpukan.
### JSON
```
1. "MyDB" : {
2. "Type" : "AWS::RDS::DBInstance",
3. "Properties" : {
4. "DBSecurityGroups" : [
5. {"Ref" : "MyDbSecurityByEC2SecurityGroup"}, {"Ref" : "MyDbSecurityByCIDRIPGroup"} ],
6. "AllocatedStorage" : "5",
7. "DBInstanceClass" : "db.t2.small",
8. "Engine" : "MySQL",
9. "MasterUsername" : "MyName",
10. "ManageMasterUserPassword" : true,
11. "MasterUserSecret" : {
12. "KmsKeyId" : {"Ref" : "KMSKey"}
13. }
14. },
15. "DeletionPolicy" : "Snapshot"
16. }
```
### YAML
```
1. MyDB:
2. Type: AWS::RDS::DBInstance
3. Properties:
4. DBSecurityGroups:
5. - Ref: MyDbSecurityByEC2SecurityGroup
6. - Ref: MyDbSecurityByCIDRIPGroup
7. AllocatedStorage: '5'
8. DBInstanceClass: db.t2.small
9. Engine: MySQL
10. MasterUsername: MyName
11. ManageMasterUserPassword: true
12. MasterUserSecret:
13. KmsKeyId: !Ref KMSKey
14. DeletionPolicy: Snapshot
```
## Sumber daya instans DB database oracle Amazon RDS
Contoh ini membuat sumber daya Oracle Database DB Instance dengan kata sandi pengguna master terkelola. Untuk informasi selengkapnya, lihat [Manajemen kata sandi dengan AWS Secrets Manager](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-secrets-manager.html) di *Panduan Pengguna Amazon RDS*. Contoh menentukan `Engine` as `oracle-ee` dengan model lisensi. bring-your-own-license [Untuk detail tentang pengaturan untuk instans Oracle Database DB, lihat Membuat. DBInstance](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_CreateDBInstance.html) Properti DBSecurity Grup mengotorisasi masuknya jaringan ke `AWS::RDS::DBSecurityGroup` sumber daya bernama MyDbSecurityBy EC2 SecurityGroup dan. MyDbSecurityBy CIDRIPGroup Lihat perinciannya di [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html). Sumber daya Instans DB juga memiliki `DeletionPolicy` atribut yang disetel ke`Snapshot`. Dengan `Snapshot` `DeletionPolicy` set, CloudFormation akan mengambil snapshot dari Instans DB ini sebelum menghapusnya selama penghapusan tumpukan.
### JSON
```
1. "MyDB" : {
2. "Type" : "AWS::RDS::DBInstance",
3. "Properties" : {
4. "DBSecurityGroups" : [
5. {"Ref" : "MyDbSecurityByEC2SecurityGroup"}, {"Ref" : "MyDbSecurityByCIDRIPGroup"} ],
6. "AllocatedStorage" : "5",
7. "DBInstanceClass" : "db.t2.small",
8. "Engine" : "oracle-ee",
9. "LicenseModel" : "bring-your-own-license",
10. "MasterUsername" : "master",
11. "ManageMasterUserPassword" : true,
12. "MasterUserSecret" : {
13. "KmsKeyId" : {"Ref" : "KMSKey"}
14. }
15. },
16. "DeletionPolicy" : "Snapshot"
17. }
```
### YAML
```
1. MyDB:
2. Type: AWS::RDS::DBInstance
3. Properties:
4. DBSecurityGroups:
5. - Ref: MyDbSecurityByEC2SecurityGroup
6. - Ref: MyDbSecurityByCIDRIPGroup
7. AllocatedStorage: '5'
8. DBInstanceClass: db.t2.small
9. Engine: oracle-ee
10. LicenseModel: bring-your-own-license
11. MasterUsername: master
12. ManageMasterUserPassword: true
13. MasterUserSecret:
14. KmsKeyId: !Ref KMSKey
15. DeletionPolicy: Snapshot
```
## Sumber daya Amazon RDS DBSecurity Group untuk rentang CIDR
Contoh ini menunjukkan `DBSecurityGroup` sumber daya Amazon RDS dengan otorisasi masuk untuk rentang CIDR yang ditentukan dalam format. `ddd.ddd.ddd.ddd/dd` [Untuk detailnya, lihat [AWS: :RDS:: DBSecurity Group dan Ingress](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbsecuritygroup.html).](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-rds-dbsecuritygroup-ingress.html)
### JSON
```
1. "MyDbSecurityByCIDRIPGroup" : {
2. "Type" : "AWS::RDS::DBSecurityGroup",
3. "Properties" : {
4. "GroupDescription" : "Ingress for CIDRIP",
5. "DBSecurityGroupIngress" : {
6. "CIDRIP" : "192.168.0.0/32"
7. }
8. }
9. }
```
### YAML
```
1. MyDbSecurityByCIDRIPGroup:
2. Type: AWS::RDS::DBSecurityGroup
3. Properties:
4. GroupDescription: Ingress for CIDRIP
5. DBSecurityGroupIngress:
6. CIDRIP: "192.168.0.0/32"
```
## Amazon RDS DBSecurity Group dengan grup EC2 keamanan Amazon
Contoh ini menunjukkan sumber daya [AWS: :RDS:: DBSecurity Grup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbsecuritygroup.html) dengan otorisasi masuk dari grup EC2 keamanan Amazon yang direferensikan oleh. `MyEc2SecurityGroup`
Untuk melakukan ini, Anda mendefinisikan grup EC2 keamanan dan kemudian menggunakan `Ref` fungsi intrinsik untuk merujuk ke grup EC2 keamanan di dalam Anda. `DBSecurityGroup`
### JSON
```
"DBInstance" : {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"DBName" : { "Ref" : "DBName" },
"Engine" : "MySQL",
"MasterUsername" : { "Ref" : "DBUsername" },
"DBInstanceClass" : { "Ref" : "DBClass" },
"DBSecurityGroups" : [ { "Ref" : "DBSecurityGroup" } ],
"AllocatedStorage" : { "Ref" : "DBAllocatedStorage" },
"MasterUserPassword": { "Ref" : "DBPassword" }
}
},
"DBSecurityGroup": {
"Type": "AWS::RDS::DBSecurityGroup",
"Properties": {
"DBSecurityGroupIngress": {
"EC2SecurityGroupName": {
"Fn::GetAtt": ["WebServerSecurityGroup", "GroupName"]
}
},
"GroupDescription" : "Frontend Access"
}
},
"WebServerSecurityGroup" : {
"Type" : "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription" : "Enable HTTP access via port 80 and SSH access",
"SecurityGroupIngress" : [
{"IpProtocol" : "tcp", "FromPort" : 80, "ToPort" : 80, "CidrIp" : "0.0.0.0/0"},
{"IpProtocol" : "tcp", "FromPort" : 22, "ToPort" : 22, "CidrIp" : "0.0.0.0/0"}
]
}
}
```
### YAML
Contoh ini diekstrak dari contoh lengkap berikut: [Drupal\$1Single\$1Instance\$1With\$1RDS.template](https://s3.amazonaws.com/cloudformation-templates-us-east-1/Drupal_Single_Instance_With_RDS.template)
```
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName:
Ref: DBName
Engine: MySQL
MasterUsername:
Ref: DBUsername
DBInstanceClass:
Ref: DBClass
DBSecurityGroups:
- Ref: DBSecurityGroup
AllocatedStorage:
Ref: DBAllocatedStorage
MasterUserPassword:
Ref: DBPassword
DBSecurityGroup:
Type: AWS::RDS::DBSecurityGroup
Properties:
DBSecurityGroupIngress:
EC2SecurityGroupName:
Ref: WebServerSecurityGroup
GroupDescription: Frontend Access
WebServerSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Enable HTTP access via port 80 and SSH access
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
- IpProtocol: tcp
FromPort: 22
ToPort: 22
CidrIp: 0.0.0.0/0
```
## Beberapa grup keamanan VPC
Contoh ini menunjukkan [AWS: :RDS:: DBSecurity Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbsecuritygroup.html) resource dengan otorisasi ingress untuk beberapa grup keamanan Amazon EC2 VPC di [AWS](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbsecuritygroupingress.html): :RDS::. DBSecurity GroupIngress
### JSON
```
{
"Resources" : {
"DBinstance" : {
"Type" : "AWS::RDS::DBInstance",
"Properties" : {
"AllocatedStorage" : "5",
"DBInstanceClass" : "db.t2.small",
"DBName" : {"Ref": "MyDBName" },
"DBSecurityGroups" : [ { "Ref" : "DbSecurityByEC2SecurityGroup" } ],
"DBSubnetGroupName" : { "Ref" : "MyDBSubnetGroup" },
"Engine" : "MySQL",
"MasterUserPassword": { "Ref" : "MyDBPassword" },
"MasterUsername" : { "Ref" : "MyDBUsername" }
},
"DeletionPolicy" : "Snapshot"
},
"DbSecurityByEC2SecurityGroup" : {
"Type" : "AWS::RDS::DBSecurityGroup",
"Properties" : {
"GroupDescription" : "Ingress for Amazon EC2 security group",
"EC2VpcId" : { "Ref" : "MyVPC" },
"DBSecurityGroupIngress" : [ {
"EC2SecurityGroupId" : "sg-b0ff1111",
"EC2SecurityGroupOwnerId" : "111122223333"
}, {
"EC2SecurityGroupId" : "sg-ffd722222",
"EC2SecurityGroupOwnerId" : "111122223333"
} ]
}
}
}
}
```
### YAML
```
Resources:
DBinstance:
Type: AWS::RDS::DBInstance
Properties:
AllocatedStorage: '5'
DBInstanceClass: db.t2.small
DBName:
Ref: MyDBName
DBSecurityGroups:
- Ref: DbSecurityByEC2SecurityGroup
DBSubnetGroupName:
Ref: MyDBSubnetGroup
Engine: MySQL
MasterUserPassword:
Ref: MyDBPassword
MasterUsername:
Ref: MyDBUsername
DeletionPolicy: Snapshot
DbSecurityByEC2SecurityGroup:
Type: AWS::RDS::DBSecurityGroup
Properties:
GroupDescription: Ingress for Amazon EC2 security group
EC2VpcId:
Ref: MyVPC
DBSecurityGroupIngress:
- EC2SecurityGroupId: sg-b0ff1111
EC2SecurityGroupOwnerId: '111122223333'
- EC2SecurityGroupId: sg-ffd722222
EC2SecurityGroupOwnerId: '111122223333'
```
## Instans database Amazon RDS dalam grup keamanan VPC
Contoh ini menunjukkan instance database Amazon RDS yang terkait dengan grup keamanan Amazon EC2 VPC.
### JSON
```
{
"DBEC2SecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties" : {
"GroupDescription": "Open database for access",
"SecurityGroupIngress" : [{
"IpProtocol" : "tcp",
"FromPort" : 3306,
"ToPort" : 3306,
"SourceSecurityGroupName" : { "Ref" : "WebServerSecurityGroup" }
}]
}
},
"DBInstance" : {
"Type": "AWS::RDS::DBInstance",
"Properties": {
"DBName" : { "Ref" : "DBName" },
"Engine" : "MySQL",
"MultiAZ" : { "Ref": "MultiAZDatabase" },
"MasterUsername" : { "Ref" : "DBUser" },
"DBInstanceClass" : { "Ref" : "DBClass" },
"AllocatedStorage" : { "Ref" : "DBAllocatedStorage" },
"MasterUserPassword": { "Ref" : "DBPassword" },
"VPCSecurityGroups" : [ { "Fn::GetAtt": [ "DBEC2SecurityGroup", "GroupId" ] } ]
}
}
}
```
### YAML
```
DBEC2SecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Open database for access
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 3306
ToPort: 3306
SourceSecurityGroupName:
Ref: WebServerSecurityGroup
DBInstance:
Type: AWS::RDS::DBInstance
Properties:
DBName:
Ref: DBName
Engine: MySQL
MultiAZ:
Ref: MultiAZDatabase
MasterUsername:
Ref: DBUser
DBInstanceClass:
Ref: DBClass
AllocatedStorage:
Ref: DBAllocatedStorage
MasterUserPassword:
Ref: DBPassword
VPCSecurityGroups:
- !GetAtt DBEC2SecurityGroup.GroupId
```
# Cuplikan templat Route 53
**Topics**
+ [Rekaman sumber daya Amazon Route 53 yang ditetapkan menggunakan nama atau ID zona yang dihosting](#scenario-route53-recordset-by-host)
+ [Menggunakan RecordSetGroup untuk mengatur set catatan sumber daya tertimbang](#scenario-recordsetgroup-weighted)
+ [Menggunakan RecordSetGroup untuk menyiapkan kumpulan catatan sumber daya alias](#scenario-recordsetgroup-zoneapex)
+ [Catatan sumber daya alias ditetapkan untuk distribusi CloudFront](#scenario-user-friendly-url-for-cloudfront-distribution)
## Rekaman sumber daya Amazon Route 53 yang ditetapkan menggunakan nama atau ID zona yang dihosting
Saat Anda membuat kumpulan catatan sumber daya Amazon Route 53, Anda harus menentukan zona yang dihosting tempat Anda ingin menambahkannya. CloudFormation menyediakan dua cara untuk menentukan zona yang dihosting:
+ Anda dapat secara eksplisit menentukan zona yang di-host menggunakan properti `HostedZoneId`.
+ Anda dapat CloudFormation menemukan zona yang dihosting menggunakan `HostedZoneName` properti. Jika Anda menggunakan `HostedZoneName` properti dan ada beberapa zona yang dihosting dengan nama yang sama, CloudFormation tidak membuat tumpukan.
### Menambahkan RecordSet menggunakan HostedZoneId
Contoh ini menambahkan kumpulan data sumber daya Amazon Route 53 yang berisi `SPF` catatan untuk nama domain `mysite.example.com` yang menggunakan `HostedZoneId` properti untuk menentukan zona yang dihosting.
#### JSON
```
1. "myDNSRecord" : {
2. "Type" : "AWS::Route53::RecordSet",
3. "Properties" :
4. {
5. "HostedZoneId" : "Z3DG6IL3SJCGPX",
6. "Name" : "mysite.example.com.",
7. "Type" : "SPF",
8. "TTL" : "900",
9. "ResourceRecords" : [ "\"v=spf1 ip4:192.168.0.1/16 -all\"" ]
10. }
11. }
```
#### YAML
```
1. myDNSRecord:
2. Type: AWS::Route53::RecordSet
3. Properties:
4. HostedZoneId: Z3DG6IL3SJCGPX
5. Name: mysite.example.com.
6. Type: SPF
7. TTL: '900'
8. ResourceRecords:
9. - '"v=spf1 ip4:192.168.0.1/16 -all"'
```
### Menambahkan RecordSet menggunakan HostedZoneName
Contoh ini menambahkan data sumber daya Amazon Route 53 yang ditetapkan untuk nama domain “mysite.example.com” menggunakan `HostedZoneName` properti untuk menentukan zona yang dihosting.
#### JSON
```
1. "myDNSRecord2" : {
2. "Type" : "AWS::Route53::RecordSet",
3. "Properties" : {
4. "HostedZoneName" : "example.com.",
5. "Name" : "mysite.example.com.",
6. "Type" : "A",
7. "TTL" : "900",
8. "ResourceRecords" : [
9. "192.168.0.1",
10. "192.168.0.2"
11. ]
12. }
13. }
```
#### YAML
```
1. myDNSRecord2:
2. Type: AWS::Route53::RecordSet
3. Properties:
4. HostedZoneName: example.com.
5. Name: mysite.example.com.
6. Type: A
7. TTL: '900'
8. ResourceRecords:
9. - 192.168.0.1
10. - 192.168.0.2
```
## Menggunakan RecordSetGroup untuk mengatur set catatan sumber daya tertimbang
Contoh ini menggunakan [AWS::Route53::RecordSetGrup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-route53-recordsetgroup.html) untuk menyiapkan dua catatan CNAME untuk “example.com.” zona yang di-host. Properti `RecordSets` mengandung set catatan CNAME untuk nama DNS "mysite.example.com". Setiap set catatan mengandung sebuah pengidentifikasi (`SetIdentifier`) dan bobot (`Weight`). Proporsi lalu lintas internet yang dirutekan ke sumber daya didasarkan pada perhitungan berikut:
+ `Frontend One`: `140/(140+60)` = `140/200` = 70%
+ `Frontend Two`: `60/(140+60)` = `60/200` = 30%
Untuk informasi selengkapnya tentang kumpulan rekaman sumber daya tertimbang, lihat [Perutean tertimbang di Panduan Pengembang](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/routing-policy-weighted.html) *Amazon Route 53*.
### JSON
```
1. "myDNSOne" : {
2. "Type" : "AWS::Route53::RecordSetGroup",
3. "Properties" : {
4. "HostedZoneName" : "example.com.",
5. "Comment" : "Weighted RR for my frontends.",
6. "RecordSets" : [
7. {
8. "Name" : "mysite.example.com.",
9. "Type" : "CNAME",
10. "TTL" : "900",
11. "SetIdentifier" : "Frontend One",
12. "Weight" : "140",
13. "ResourceRecords" : ["example-ec2.amazonaws.com"]
14. },
15. {
16. "Name" : "mysite.example.com.",
17. "Type" : "CNAME",
18. "TTL" : "900",
19. "SetIdentifier" : "Frontend Two",
20. "Weight" : "60",
21. "ResourceRecords" : ["example-ec2-larger.amazonaws.com"]
22. }
23. ]
24. }
25. }
```
### YAML
```
1. myDNSOne:
2. Type: AWS::Route53::RecordSetGroup
3. Properties:
4. HostedZoneName: example.com.
5. Comment: Weighted RR for my frontends.
6. RecordSets:
7. - Name: mysite.example.com.
8. Type: CNAME
9. TTL: '900'
10. SetIdentifier: Frontend One
11. Weight: '140'
12. ResourceRecords:
13. - example-ec2.amazonaws.com
14. - Name: mysite.example.com.
15. Type: CNAME
16. TTL: '900'
17. SetIdentifier: Frontend Two
18. Weight: '60'
19. ResourceRecords:
20. - example-ec2-larger.amazonaws.com
```
## Menggunakan RecordSetGroup untuk menyiapkan kumpulan catatan sumber daya alias
Contoh berikut menggunakan [AWS::Route53::RecordSetGrup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-route53-recordsetgroup.html) untuk menyiapkan kumpulan catatan sumber daya alias bernama `example.com` yang merutekan lalu lintas ke penyeimbang beban ELB Versi 1 (Klasik) dan penyeimbang beban Versi 2 (Aplikasi atau Jaringan). [AliasTarget](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-route53-recordset-aliastarget.html)Properti menentukan ID zona host dan nama DNS untuk `myELB` `LoadBalancer` dengan menggunakan fungsi `GetAtt` intrinsik. `GetAtt`mengambil properti `myELB` sumber daya yang berbeda, tergantung pada apakah Anda merutekan lalu lintas ke penyeimbang beban Versi 1 atau Versi 2:
+ Penyeimbang beban Versi 1: `CanonicalHostedZoneNameID` dan `DNSName`
+ Penyeimbang beban Versi 2: `CanonicalHostedZoneID` dan `DNSName`
Untuk informasi selengkapnya tentang kumpulan rekaman sumber daya alias, lihat [Memilih antara catatan alias dan non-alias](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html) di Panduan Pengembang *Route* 53.
### JSON untuk penyeimbang beban versi 1
```
1. "myELB" : {
2. "Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
3. "Properties" : {
4. "AvailabilityZones" : [ "us-east-1a" ],
5. "Listeners" : [ {
6. "LoadBalancerPort" : "80",
7. "InstancePort" : "80",
8. "Protocol" : "HTTP"
9. } ]
10. }
11. },
12. "myDNS" : {
13. "Type" : "AWS::Route53::RecordSetGroup",
14. "Properties" : {
15. "HostedZoneName" : "example.com.",
16. "Comment" : "Zone apex alias targeted to myELB LoadBalancer.",
17. "RecordSets" : [
18. {
19. "Name" : "example.com.",
20. "Type" : "A",
21. "AliasTarget" : {
22. "HostedZoneId" : { "Fn::GetAtt" : ["myELB", "CanonicalHostedZoneNameID"] },
23. "DNSName" : { "Fn::GetAtt" : ["myELB","DNSName"] }
24. }
25. }
26. ]
27. }
28. }
```
### YAML untuk penyeimbang beban versi 1
```
1. myELB:
2. Type: AWS::ElasticLoadBalancing::LoadBalancer
3. Properties:
4. AvailabilityZones:
5. - "us-east-1a"
6. Listeners:
7. - LoadBalancerPort: '80'
8. InstancePort: '80'
9. Protocol: HTTP
10. myDNS:
11. Type: AWS::Route53::RecordSetGroup
12. Properties:
13. HostedZoneName: example.com.
14. Comment: Zone apex alias targeted to myELB LoadBalancer.
15. RecordSets:
16. - Name: example.com.
17. Type: A
18. AliasTarget:
19. HostedZoneId: !GetAtt 'myELB.CanonicalHostedZoneNameID'
20. DNSName: !GetAtt 'myELB.DNSName'
```
### JSON untuk penyeimbang beban versi 2
```
1. "myELB" : {
2. "Type" : "AWS::ElasticLoadBalancing::LoadBalancer",
3. "Properties" : {
4. "Subnets" : [
5. {"Ref": "SubnetAZ1"},
6. {"Ref" : "SubnetAZ2"}
7. ]
8. }
9. },
10. "myDNS" : {
11. "Type" : "AWS::Route53::RecordSetGroup",
12. "Properties" : {
13. "HostedZoneName" : "example.com.",
14. "Comment" : "Zone apex alias targeted to myELB LoadBalancer.",
15. "RecordSets" : [
16. {
17. "Name" : "example.com.",
18. "Type" : "A",
19. "AliasTarget" : {
20. "HostedZoneId" : { "Fn::GetAtt" : ["myELB", "CanonicalHostedZoneID"] },
21. "DNSName" : { "Fn::GetAtt" : ["myELB","DNSName"] }
22. }
23. }
24. ]
25. }
26. }
```
### YAML untuk penyeimbang beban versi 2
```
1. myELB:
2. Type: AWS::ElasticLoadBalancingV2::LoadBalancer
3. Properties:
4. Subnets:
5. - Ref: SubnetAZ1
6. - Ref: SubnetAZ2
7. myDNS:
8. Type: AWS::Route53::RecordSetGroup
9. Properties:
10. HostedZoneName: example.com.
11. Comment: Zone apex alias targeted to myELB LoadBalancer.
12. RecordSets:
13. - Name: example.com.
14. Type: A
15. AliasTarget:
16. HostedZoneId: !GetAtt 'myELB.CanonicalHostedZoneID'
17. DNSName: !GetAtt 'myELB.DNSName'
```
## Catatan sumber daya alias ditetapkan untuk distribusi CloudFront
Contoh berikut membuat catatan alias A yang mengarahkan nama domain kustom ke CloudFront distribusi yang ada. `myHostedZoneID`diasumsikan sebagai referensi ke `AWS::Route53::HostedZone` sumber daya aktual dalam template atau parameter yang sama. `myCloudFrontDistribution`mengacu pada sumber `AWS::CloudFront::Distribution` daya dalam template yang sama. Catatan alias menggunakan ID zona CloudFront host standar (`Z2FDTNDATAQYW2`) dan secara otomatis menyelesaikan nama domain distribusi menggunakan. `Fn::GetAtt` Pengaturan ini memungkinkan lalu lintas web dialihkan dari domain khusus ke CloudFront distribusi tanpa memerlukan alamat IP.
**catatan**
Ketika Anda membuat kumpulan catatan sumber daya alias, Anda harus menentukan `Z2FDTNDATAQYW2` untuk `HostedZoneId` properti. Kumpulan catatan sumber daya alias untuk tidak CloudFront dapat dibuat di zona pribadi.
### JSON
```
1. {
2. "myDNS": {
3. "Type": "AWS::Route53::RecordSetGroup",
4. "Properties": {
5. "HostedZoneId": {
6. "Ref": "myHostedZoneID"
7. },
8. "RecordSets": [
9. {
10. "Name": {
11. "Ref": "myRecordSetDomainName"
12. },
13. "Type": "A",
14. "AliasTarget": {
15. "HostedZoneId": "Z2FDTNDATAQYW2",
16. "DNSName": {
17. "Fn::GetAtt": [
18. "myCloudFrontDistribution",
19. "DomainName"
20. ]
21. },
22. "EvaluateTargetHealth": false
23. }
24. }
25. ]
26. }
27. }
28. }
```
### YAML
```
1. myDNS:
2. Type: AWS::Route53::RecordSetGroup
3. Properties:
4. HostedZoneId: !Ref myHostedZoneID
5. RecordSets:
6. - Name: !Ref myRecordSetDomainName
7. Type: A
8. AliasTarget:
9. HostedZoneId: Z2FDTNDATAQYW2
10. DNSName: !GetAtt
11. - myCloudFrontDistribution
12. - DomainName
13. EvaluateTargetHealth: false
```
# Cuplikan template Amazon S3
Gunakan contoh template Amazon S3 ini untuk membantu mendeskripsikan bucket Amazon S3 Anda. CloudFormation Untuk contoh lainnya, lihat bagian [Contoh](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-s3-bucket.html#aws-resource-s3-bucket--examples) di `AWS::S3::Bucket` sumber daya.
**Topics**
+ [Membuat bucket Amazon S3 dengan default](#scenario-s3-bucket)
+ [Membuat bucket Amazon S3 untuk hosting situs web dan dengan `DeletionPolicy`](#scenario-s3-bucket-website)
+ [Pembuatan situs web statis menggunakan domain kustom](#scenario-s3-bucket-website-customdomain)
## Membuat bucket Amazon S3 dengan default
Contoh ini menggunakan a [AWS::S3::Bucket](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-s3-bucket.html)untuk membuat bucket dengan pengaturan default.
### JSON
```
1. "myS3Bucket" : {
2. "Type" : "AWS::S3::Bucket"
3. }
```
### YAML
```
1. MyS3Bucket:
2. Type: AWS::S3::Bucket
```
## Membuat bucket Amazon S3 untuk hosting situs web dan dengan `DeletionPolicy`
Contoh ini membuat bucket sebagai situs web dan menonaktifkan Blokir Akses Publik (izin baca publik diperlukan untuk bucket yang disiapkan untuk hosting situs web). Kebijakan bucket publik kemudian ditambahkan ke bucket. Karena sumber daya bucket ini memiliki `DeletionPolicy` atribut yang disetel ke`Retain`, tidak CloudFormation akan menghapus bucket ini saat menghapus tumpukan. `Output`Bagian ini digunakan `Fn::GetAtt` untuk mengambil `WebsiteURL` atribut dan `DomainName` atribut `S3Bucket` sumber daya.
**catatan**
Contoh berikut mengasumsikan pengaturan `BlockPublicPolicy` dan `RestrictPublicBuckets` Blokir Akses Publik telah dinonaktifkan di tingkat akun.
### JSON
```
1. {
2. "AWSTemplateFormatVersion": "2010-09-09",
3. "Resources": {
4. "S3Bucket": {
5. "Type": "AWS::S3::Bucket",
6. "Properties": {
7. "PublicAccessBlockConfiguration": {
8. "BlockPublicAcls": false,
9. "BlockPublicPolicy": false,
10. "IgnorePublicAcls": false,
11. "RestrictPublicBuckets": false
12. },
13. "WebsiteConfiguration": {
14. "IndexDocument": "index.html",
15. "ErrorDocument": "error.html"
16. }
17. },
18. "DeletionPolicy": "Retain",
19. "UpdateReplacePolicy": "Retain"
20. },
21. "BucketPolicy": {
22. "Type": "AWS::S3::BucketPolicy",
23. "Properties": {
24. "PolicyDocument": {
25. "Id": "MyPolicy",
26. "Version": "2012-10-17",
27. "Statement": [
28. {
29. "Sid": "PublicReadForGetBucketObjects",
30. "Effect": "Allow",
31. "Principal": "*",
32. "Action": "s3:GetObject",
33. "Resource": {
34. "Fn::Join": [
35. "",
36. [
37. "arn:aws:s3:::",
38. {
39. "Ref": "S3Bucket"
40. },
41. "/*"
42. ]
43. ]
44. }
45. }
46. ]
47. },
48. "Bucket": {
49. "Ref": "S3Bucket"
50. }
51. }
52. }
53. },
54. "Outputs": {
55. "WebsiteURL": {
56. "Value": {
57. "Fn::GetAtt": [
58. "S3Bucket",
59. "WebsiteURL"
60. ]
61. },
62. "Description": "URL for website hosted on S3"
63. },
64. "S3BucketSecureURL": {
65. "Value": {
66. "Fn::Join": [
67. "",
68. [
69. "https://",
70. {
71. "Fn::GetAtt": [
72. "S3Bucket",
73. "DomainName"
74. ]
75. }
76. ]
77. ]
78. },
79. "Description": "Name of S3 bucket to hold website content"
80. }
81. }
82. }
```
### YAML
```
1. AWSTemplateFormatVersion: 2010-09-09
2. Resources:
3. S3Bucket:
4. Type: AWS::S3::Bucket
5. Properties:
6. PublicAccessBlockConfiguration:
7. BlockPublicAcls: false
8. BlockPublicPolicy: false
9. IgnorePublicAcls: false
10. RestrictPublicBuckets: false
11. WebsiteConfiguration:
12. IndexDocument: index.html
13. ErrorDocument: error.html
14. DeletionPolicy: Retain
15. UpdateReplacePolicy: Retain
16. BucketPolicy:
17. Type: AWS::S3::BucketPolicy
18. Properties:
19. PolicyDocument:
20. Id: MyPolicy
21. Version: 2012-10-17
22. Statement:
23. - Sid: PublicReadForGetBucketObjects
24. Effect: Allow
25. Principal: '*'
26. Action: 's3:GetObject'
27. Resource: !Join
28. - ''
29. - - 'arn:aws:s3:::'
30. - !Ref S3Bucket
31. - /*
32. Bucket: !Ref S3Bucket
33. Outputs:
34. WebsiteURL:
35. Value: !GetAtt
36. - S3Bucket
37. - WebsiteURL
38. Description: URL for website hosted on S3
39. S3BucketSecureURL:
40. Value: !Join
41. - ''
42. - - 'https://'
43. - !GetAtt
44. - S3Bucket
45. - DomainName
46. Description: Name of S3 bucket to hold website content
```
## Pembuatan situs web statis menggunakan domain kustom
Anda dapat menggunakan Route 53 dengan domain terdaftar. Contoh berikut mengasumsikan bahwa Anda telah membuat zona yang dihosting di Route 53 untuk domain Anda. Contoh ini membuat dua bucket untuk hosting situs web. Bucket root meng-host konten, dan bucket lainnya mengalihkan permintaan `www.domainname.com` ke bucket root. Kumpulan catatan memetakan nama domain Anda ke titik akhir Amazon S3.
Anda juga perlu menambahkan kebijakan bucket, seperti yang ditunjukkan pada contoh di atas.
Untuk informasi selengkapnya tentang penggunaan domain kustom, lihat [Tutorial: Mengonfigurasi situs web statis menggunakan domain kustom yang terdaftar dengan Route 53](https://docs.aws.amazon.com/AmazonS3/latest/userguide/website-hosting-custom-domain-walkthrough.html) di *Panduan Pengguna Layanan Penyimpanan Sederhana Amazon*.
**catatan**
Contoh berikut mengasumsikan pengaturan `BlockPublicPolicy` dan `RestrictPublicBuckets` Blokir Akses Publik telah dinonaktifkan di tingkat akun.
### JSON
```
{
"AWSTemplateFormatVersion": "2010-09-09",
"Mappings" : {
"RegionMap" : {
"us-east-1" : { "S3hostedzoneID" : "Z3AQBSTGFYJSTF", "websiteendpoint" : "s3-website-us-east-1.amazonaws.com" },
"us-west-1" : { "S3hostedzoneID" : "Z2F56UZL2M1ACD", "websiteendpoint" : "s3-website-us-west-1.amazonaws.com" },
"us-west-2" : { "S3hostedzoneID" : "Z3BJ6K6RIION7M", "websiteendpoint" : "s3-website-us-west-2.amazonaws.com" },
"eu-west-1" : { "S3hostedzoneID" : "Z1BKCTXD74EZPE", "websiteendpoint" : "s3-website-eu-west-1.amazonaws.com" },
"ap-southeast-1" : { "S3hostedzoneID" : "Z3O0J2DXBE1FTB", "websiteendpoint" : "s3-website-ap-southeast-1.amazonaws.com" },
"ap-southeast-2" : { "S3hostedzoneID" : "Z1WCIGYICN2BYD", "websiteendpoint" : "s3-website-ap-southeast-2.amazonaws.com" },
"ap-northeast-1" : { "S3hostedzoneID" : "Z2M4EHUR26P7ZW", "websiteendpoint" : "s3-website-ap-northeast-1.amazonaws.com" },
"sa-east-1" : { "S3hostedzoneID" : "Z31GFT0UA1I2HV", "websiteendpoint" : "s3-website-sa-east-1.amazonaws.com" }
}
},
"Parameters": {
"RootDomainName": {
"Description": "Domain name for your website (example.com)",
"Type": "String"
}
},
"Resources": {
"RootBucket": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketName" : {"Ref":"RootDomainName"},
"PublicAccessBlockConfiguration": {
"BlockPublicAcls": false,
"BlockPublicPolicy": false,
"IgnorePublicAcls": false,
"RestrictPublicBuckets": false
},
"WebsiteConfiguration": {
"IndexDocument":"index.html",
"ErrorDocument":"404.html"
}
}
},
"WWWBucket": {
"Type": "AWS::S3::Bucket",
"Properties": {
"BucketName": {
"Fn::Join": ["", ["www.", {"Ref":"RootDomainName"}]]
},
"AccessControl": "BucketOwnerFullControl",
"WebsiteConfiguration": {
"RedirectAllRequestsTo": {
"HostName": {"Ref": "RootBucket"}
}
}
}
},
"myDNS": {
"Type": "AWS::Route53::RecordSetGroup",
"Properties": {
"HostedZoneName": {
"Fn::Join": ["", [{"Ref": "RootDomainName"}, "."]]
},
"Comment": "Zone apex alias.",
"RecordSets": [
{
"Name": {"Ref": "RootDomainName"},
"Type": "A",
"AliasTarget": {
"HostedZoneId": {"Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "S3hostedzoneID"]},
"DNSName": {"Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "websiteendpoint"]}
}
},
{
"Name": {
"Fn::Join": ["", ["www.", {"Ref":"RootDomainName"}]]
},
"Type": "CNAME",
"TTL" : "900",
"ResourceRecords" : [
{"Fn::GetAtt":["WWWBucket", "DomainName"]}
]
}
]
}
}
},
"Outputs": {
"WebsiteURL": {
"Value": {"Fn::GetAtt": ["RootBucket", "WebsiteURL"]},
"Description": "URL for website hosted on S3"
}
}
}
```
### YAML
```
Parameters:
RootDomainName:
Description: Domain name for your website (example.com)
Type: String
Mappings:
RegionMap:
us-east-1:
S3hostedzoneID: Z3AQBSTGFYJSTF
websiteendpoint: s3-website-us-east-1.amazonaws.com
us-west-1:
S3hostedzoneID: Z2F56UZL2M1ACD
websiteendpoint: s3-website-us-west-1.amazonaws.com
us-west-2:
S3hostedzoneID: Z3BJ6K6RIION7M
websiteendpoint: s3-website-us-west-2.amazonaws.com
eu-west-1:
S3hostedzoneID: Z1BKCTXD74EZPE
websiteendpoint: s3-website-eu-west-1.amazonaws.com
ap-southeast-1:
S3hostedzoneID: Z3O0J2DXBE1FTB
websiteendpoint: s3-website-ap-southeast-1.amazonaws.com
ap-southeast-2:
S3hostedzoneID: Z1WCIGYICN2BYD
websiteendpoint: s3-website-ap-southeast-2.amazonaws.com
ap-northeast-1:
S3hostedzoneID: Z2M4EHUR26P7ZW
websiteendpoint: s3-website-ap-northeast-1.amazonaws.com
sa-east-1:
S3hostedzoneID: Z31GFT0UA1I2HV
websiteendpoint: s3-website-sa-east-1.amazonaws.com
Resources:
RootBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Ref RootDomainName
PublicAccessBlockConfiguration:
BlockPublicAcls: false
BlockPublicPolicy: false
IgnorePublicAcls: false
RestrictPublicBuckets: false
WebsiteConfiguration:
IndexDocument: index.html
ErrorDocument: 404.html
WWWBucket:
Type: AWS::S3::Bucket
Properties:
BucketName: !Sub
- www.${Domain}
- Domain: !Ref RootDomainName
AccessControl: BucketOwnerFullControl
WebsiteConfiguration:
RedirectAllRequestsTo:
HostName: !Ref RootBucket
myDNS:
Type: AWS::Route53::RecordSetGroup
Properties:
HostedZoneName: !Sub
- ${Domain}.
- Domain: !Ref RootDomainName
Comment: Zone apex alias.
RecordSets:
- Name: !Ref RootDomainName
Type: A
AliasTarget:
HostedZoneId: !FindInMap [ RegionMap, !Ref 'AWS::Region', S3hostedzoneID]
DNSName: !FindInMap [ RegionMap, !Ref 'AWS::Region', websiteendpoint]
- Name: !Sub
- www.${Domain}
- Domain: !Ref RootDomainName
Type: CNAME
TTL: 900
ResourceRecords:
- !GetAtt WWWBucket.DomainName
Outputs:
WebsiteURL:
Value: !GetAtt RootBucket.WebsiteURL
Description: URL for website hosted on S3
```
# Cuplikan template Amazon SNS
Contoh ini menunjukkan sumber daya topik Amazon SNS. Ini membutuhkan alamat email yang valid.
## JSON
```
1. "MySNSTopic" : {
2. "Type" : "AWS::SNS::Topic",
3. "Properties" : {
4. "Subscription" : [ {
5. "Endpoint" : "add valid email address",
6. "Protocol" : "email"
7. } ]
8. }
9. }
```
## YAML
```
1. MySNSTopic:
2. Type: AWS::SNS::Topic
3. Properties:
4. Subscription:
5. - Endpoint: "add valid email address"
6. Protocol: email
```
# Cuplikan template Amazon SQS
Contoh ini menunjukkan antrian Amazon SQS.
## JSON
```
1. "MyQueue" : {
2. "Type" : "AWS::SQS::Queue",
3. "Properties" : {
4. "VisibilityTimeout" : "value"
5. }
6. }
```
## YAML
```
1. MyQueue:
2. Type: AWS::SQS::Queue
3. Properties:
4. VisibilityTimeout: value
```
# Cuplikan template Amazon Timestream
Amazon TimeStream untuk InfluxDB memudahkan pengembang dan DevOps tim aplikasi untuk menjalankan database InfluxDB yang dikelola sepenuhnya untuk aplikasi deret waktu nyata menggunakan sumber terbuka. AWS APIs Anda dapat dengan cepat membuat database InfluxDB yang menangani beban kerja deret waktu yang menuntut. Dengan beberapa panggilan API sederhana, Anda dapat mengatur, memigrasi, mengoperasikan, dan menskalakan database InfluxDB AWS dengan penambalan, pencadangan, dan pemulihan perangkat lunak otomatis. Anda juga dapat menemukan sampel ini di [awslabs/amazon-timestream-tools/tree/mainline/integrations/cloudformation/timestream-influxdb](https://github.com/awslabs/amazon-timestream-tools/tree/mainline/integrations/cloudformation/timestream-influxdb) on. GitHub
**Topics**
+ [Sampel minimal menggunakan nilai default](#scenario-timestream-influxdb-example-1)
+ [Contoh yang lebih lengkap dengan parameter](#scenario-timestream-influxdb-example-2)
CloudFormation Template ini membuat sumber daya berikut yang diperlukan untuk berhasil membuat, menyambungkan, dan memantau Amazon Timestream untuk instans InfluxDB:
**Amazon VPC**
+ `VPC`
+ Satu atau lebih `Subnet`
+ `InternetGateway`
+ `RouteTable`
+ `SecurityGroup`
**Amazon S3**
+ `Bucket`
**Amazon Timestream**
+ `InfluxDBInstance`
## Sampel minimal menggunakan nilai default
Contoh ini menyebarkan instans multi-AZ dan dapat diakses publik menggunakan nilai default jika memungkinkan.
### JSON
```
{
"Metadata": {
"AWS::CloudFormation::Interface": {
"ParameterGroups": [
{
"Label": {"default": "Amazon Timestream for InfluxDB Configuration"},
"Parameters": [
"DbInstanceName",
"InfluxDBPassword"
]
}
],
"ParameterLabels": {
"VPCCIDR": {"default": "VPC CIDR"}
}
}
},
"Parameters": {
"DbInstanceName": {
"Description": "The name that uniquely identifies the DB instance when interacting with the Amazon Timestream for InfluxDB API and CLI commands. This name will also be a prefix included in the endpoint. DB instance names must be unique per customer and per Region.",
"Type": "String",
"Default": "mydbinstance",
"MinLength": 3,
"MaxLength": 40,
"AllowedPattern": "^[a-zA-z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$"
},
"InfluxDBPassword": {
"Description": "The password of the initial admin user created in InfluxDB. This password will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS Secrets Manager in your account.",
"Type": "String",
"NoEcho": true,
"MinLength": 8,
"MaxLength": 64,
"AllowedPattern": "^[a-zA-Z0-9]+$"
}
},
"Resources": {
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {"CidrBlock": "10.0.0.0/16"}
},
"InternetGateway": {"Type": "AWS::EC2::InternetGateway"},
"InternetGatewayAttachment": {
"Type": "AWS::EC2::VPCGatewayAttachment",
"Properties": {
"InternetGatewayId": {"Ref": "InternetGateway"},
"VpcId": {"Ref": "VPC"}
}
},
"Subnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {"Ref": "VPC"},
"AvailabilityZone": {
"Fn::Select": [
0,
{"Fn::GetAZs": ""}
]
},
"CidrBlock": {
"Fn::Select": [
0,
{
"Fn::Cidr": [
{
"Fn::GetAtt": [
"VPC",
"CidrBlock"
]
},
2,
12
]
}
]
},
"MapPublicIpOnLaunch": true
}
},
"Subnet2": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {"Ref": "VPC"},
"AvailabilityZone": {
"Fn::Select": [
1,
{"Fn::GetAZs": ""}
]
},
"CidrBlock": {
"Fn::Select": [
1,
{
"Fn::Cidr": [
{
"Fn::GetAtt": [
"VPC",
"CidrBlock"
]
},
2,
12
]
}
]
},
"MapPublicIpOnLaunch": true
}
},
"RouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {"Ref": "VPC"}
}
},
"DefaultRoute": {
"Type": "AWS::EC2::Route",
"DependsOn": "InternetGatewayAttachment",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {"Ref": "InternetGateway"}
}
},
"Subnet1RouteTableAssociation": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"SubnetId": {"Ref": "Subnet1"}
}
},
"Subnet2RouteTableAssociation": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"SubnetId": {"Ref": "Subnet2"}
}
},
"InfluxDBSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "influxdb-sg",
"GroupDescription": "Security group allowing port 8086 ingress for InfluxDB",
"VpcId": {"Ref": "VPC"}
}
},
"InfluxDBSecurityGroupIngress": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {"Ref": "InfluxDBSecurityGroup"},
"IpProtocol": "tcp",
"CidrIp": "0.0.0.0/0",
"FromPort": 8086,
"ToPort": 8086
}
},
"InfluxDBLogsS3Bucket": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
},
"InfluxDBLogsS3BucketPolicy": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {"Ref": "InfluxDBLogsS3Bucket"},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:PutObject",
"Effect": "Allow",
"Resource": {"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}/InfluxLogs/*"},
"Principal": {"Service": "timestream-influxdb.amazonaws.com"}
},
{
"Action": "s3:*",
"Effect": "Deny",
"Resource": [
{"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}/*"},
{"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}"}
],
"Principal": "*",
"Condition": {
"Bool": {"aws:SecureTransport": false}
}
}
]
}
}
},
"DbInstance": {
"Type": "AWS::Timestream::InfluxDBInstance",
"DependsOn": "InfluxDBLogsS3BucketPolicy",
"Properties": {
"AllocatedStorage": 20,
"DbInstanceType": "db.influx.medium",
"Name": {"Ref": "DbInstanceName"},
"Password": {"Ref": "InfluxDBPassword"},
"PubliclyAccessible": true,
"DeploymentType": "WITH_MULTIAZ_STANDBY",
"VpcSecurityGroupIds": [
{"Ref": "InfluxDBSecurityGroup"}
],
"VpcSubnetIds": [
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
],
"LogDeliveryConfiguration": {
"S3Configuration": {
"BucketName": {"Ref": "InfluxDBLogsS3Bucket"},
"Enabled": true
}
}
}
}
},
"Outputs": {
"VPC": {
"Description": "A reference to the VPC used to create network resources",
"Value": {"Ref": "VPC"}
},
"Subnets": {
"Description": "A list of the subnets created",
"Value": {
"Fn::Join": [
",",
[
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
]
]
}
},
"Subnet1": {
"Description": "A reference to the subnet in the 1st Availability Zone",
"Value": {"Ref": "Subnet1"}
},
"Subnet2": {
"Description": "A reference to the subnet in the 2nd Availability Zone",
"Value": {"Ref": "Subnet2"}
},
"InfluxDBSecurityGroup": {
"Description": "Security group with port 8086 ingress rule",
"Value": {"Ref": "InfluxDBSecurityGroup"}
},
"InfluxDBLogsS3Bucket": {
"Description": "S3 Bucket containing InfluxDB logs from the DB instance",
"Value": {"Ref": "InfluxDBLogsS3Bucket"}
},
"DbInstance": {
"Description": "A reference to the Timestream for InfluxDB DB instance",
"Value": {"Ref": "DbInstance"}
},
"InfluxAuthParametersSecretArn": {
"Description": "The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the initial InfluxDB authorization parameters. The secret value is a JSON formatted key-value pair holding InfluxDB authorization values: organization, bucket, username, and password.",
"Value": {
"Fn::GetAtt": [
"DbInstance",
"InfluxAuthParametersSecretArn"
]
}
},
"Endpoint": {
"Description": "The endpoint URL to connect to InfluxDB",
"Value": {
"Fn::Join": [
"",
[
"https://",
{
"Fn::GetAtt": [
"DbInstance",
"Endpoint"
]
},
":8086"
]
]
}
}
}
}
```
### YAML
```
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
-
Label:
default: "Amazon Timestream for InfluxDB Configuration"
Parameters:
- DbInstanceName
- InfluxDBPassword
ParameterLabels:
VPCCIDR:
default: VPC CIDR
Parameters:
DbInstanceName:
Description: The name that uniquely identifies the DB instance when interacting with the Amazon Timestream for InfluxDB API and CLI commands. This name will also be a prefix included in the endpoint. DB instance names must be unique per customer and per Region.
Type: String
Default: mydbinstance
MinLength: 3
MaxLength: 40
AllowedPattern: ^[a-zA-z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$
InfluxDBPassword:
Description: The password of the initial admin user created in InfluxDB. This password will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS Secrets Manager in your account.
Type: String
NoEcho: true
MinLength: 8
MaxLength: 64
AllowedPattern: ^[a-zA-Z0-9]+$
Resources:
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.0.0.0/16
InternetGateway:
Type: AWS::EC2::InternetGateway
InternetGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
InternetGatewayId: !Ref InternetGateway
VpcId: !Ref VPC
Subnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
AvailabilityZone: !Select [0, !GetAZs '']
CidrBlock: !Select [0, !Cidr [!GetAtt VPC.CidrBlock, 2, 12 ]]
MapPublicIpOnLaunch: true
Subnet2:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
AvailabilityZone: !Select [1, !GetAZs '']
CidrBlock: !Select [1, !Cidr [!GetAtt VPC.CidrBlock, 2, 12 ]]
MapPublicIpOnLaunch: true
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
DefaultRoute:
Type: AWS::EC2::Route
DependsOn: InternetGatewayAttachment
Properties:
RouteTableId: !Ref RouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
Subnet1RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref Subnet1
Subnet2RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref Subnet2
InfluxDBSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: "influxdb-sg"
GroupDescription: "Security group allowing port 8086 ingress for InfluxDB"
VpcId: !Ref VPC
InfluxDBSecurityGroupIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !Ref InfluxDBSecurityGroup
IpProtocol: tcp
CidrIp: 0.0.0.0/0
FromPort: 8086
ToPort: 8086
InfluxDBLogsS3Bucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
InfluxDBLogsS3BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref InfluxDBLogsS3Bucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Action: "s3:PutObject"
Effect: Allow
Resource: !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}/InfluxLogs/*
Principal:
Service: timestream-influxdb.amazonaws.com
- Action: "s3:*"
Effect: Deny
Resource:
- !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}/*
- !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}
Principal: "*"
Condition:
Bool:
aws:SecureTransport: false
DbInstance:
Type: AWS::Timestream::InfluxDBInstance
DependsOn: InfluxDBLogsS3BucketPolicy
Properties:
AllocatedStorage: 20
DbInstanceType: db.influx.medium
Name: !Ref DbInstanceName
Password: !Ref InfluxDBPassword
PubliclyAccessible: true
DeploymentType: WITH_MULTIAZ_STANDBY
VpcSecurityGroupIds:
- !Ref InfluxDBSecurityGroup
VpcSubnetIds:
- !Ref Subnet1
- !Ref Subnet2
LogDeliveryConfiguration:
S3Configuration:
BucketName: !Ref InfluxDBLogsS3Bucket
Enabled: true
Outputs:
# Network Resources
VPC:
Description: A reference to the VPC used to create network resources
Value: !Ref VPC
Subnets:
Description: A list of the subnets created
Value: !Join [",", [!Ref Subnet1, !Ref Subnet2]]
Subnet1:
Description: A reference to the subnet in the 1st Availability Zone
Value: !Ref Subnet1
Subnet2:
Description: A reference to the subnet in the 2nd Availability Zone
Value: !Ref Subnet2
InfluxDBSecurityGroup:
Description: Security group with port 8086 ingress rule
Value: !Ref InfluxDBSecurityGroup
# Timestream for InfluxDB Resources
InfluxDBLogsS3Bucket:
Description: S3 Bucket containing InfluxDB logs from the DB instance
Value: !Ref InfluxDBLogsS3Bucket
DbInstance:
Description: A reference to the Timestream for InfluxDB DB instance
Value: !Ref DbInstance
InfluxAuthParametersSecretArn:
Description: "The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the initial InfluxDB authorization parameters. The secret value is a JSON formatted key-value pair holding InfluxDB authorization values: organization, bucket, username, and password."
Value: !GetAtt DbInstance.InfluxAuthParametersSecretArn
Endpoint:
Description: The endpoint URL to connect to InfluxDB
Value: !Join ["", ["https://", !GetAtt DbInstance.Endpoint, ":8086"]]
```
## Contoh yang lebih lengkap dengan parameter
Contoh template ini secara dinamis mengubah sumber daya jaringan berdasarkan parameter yang disediakan. Parameter termasuk `PubliclyAccessible` dan`DeploymentType`.
### JSON
```
{
"Metadata": {
"AWS::CloudFormation::Interface": {
"ParameterGroups": [
{
"Label": {"default": "Network Configuration"},
"Parameters": ["VPCCIDR"]
},
{
"Label": {"default": "Amazon Timestream for InfluxDB Configuration"},
"Parameters": [
"DbInstanceName",
"InfluxDBUsername",
"InfluxDBPassword",
"InfluxDBOrganization",
"InfluxDBBucket",
"DbInstanceType",
"DbStorageType",
"AllocatedStorage",
"PubliclyAccessible",
"DeploymentType"
]
}
],
"ParameterLabels": {
"VPCCIDR": {"default": "VPC CIDR"}
}
}
},
"Parameters": {
"VPCCIDR": {
"Description": "Please enter the IP range (CIDR notation) for the new VPC",
"Type": "String",
"Default": "10.0.0.0/16"
},
"DbInstanceName": {
"Description": "The name that uniquely identifies the DB instance when interacting with the Amazon Timestream for InfluxDB API and CLI commands. This name will also be a prefix included in the endpoint. DB instance names must be unique per customer and per Region.",
"Type": "String",
"Default": "mydbinstance",
"MinLength": 3,
"MaxLength": 40,
"AllowedPattern": "^[a-zA-z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$"
},
"InfluxDBUsername": {
"Description": "The username of the initial admin user created in InfluxDB. Must start with a letter and can't end with a hyphen or contain two consecutive hyphens. For example, my-user1. This username will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS Secrets Manager in your account.",
"Type": "String",
"Default": "admin",
"MinLength": 1,
"MaxLength": 64
},
"InfluxDBPassword": {
"Description": "The password of the initial admin user created in InfluxDB. This password will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS Secrets Manager in your account.",
"Type": "String",
"NoEcho": true,
"MinLength": 8,
"MaxLength": 64,
"AllowedPattern": "^[a-zA-Z0-9]+$"
},
"InfluxDBOrganization": {
"Description": "The name of the initial organization for the initial admin user in InfluxDB. An InfluxDB organization is a workspace for a group of users.",
"Type": "String",
"Default": "org",
"MinLength": 1,
"MaxLength": 64
},
"InfluxDBBucket": {
"Description": "The name of the initial InfluxDB bucket. All InfluxDB data is stored in a bucket. A bucket combines the concept of a database and a retention period (the duration of time that each data point persists). A bucket belongs to an organization.",
"Type": "String",
"Default": "bucket",
"MinLength": 2,
"MaxLength": 64,
"AllowedPattern": "^[^_\\\"][^\\\"]*$"
},
"DeploymentType": {
"Description": "Specifies whether the Timestream for InfluxDB is deployed as Single-AZ or with a MultiAZ Standby for High availability",
"Type": "String",
"Default": "WITH_MULTIAZ_STANDBY",
"AllowedValues": [
"SINGLE_AZ",
"WITH_MULTIAZ_STANDBY"
]
},
"AllocatedStorage": {
"Description": "The amount of storage to allocate for your DB storage type in GiB (gibibytes).",
"Type": "Number",
"Default": 400,
"MinValue": 20,
"MaxValue": 16384
},
"DbInstanceType": {
"Description": "The Timestream for InfluxDB DB instance type to run InfluxDB on.",
"Type": "String",
"Default": "db.influx.medium",
"AllowedValues": [
"db.influx.medium",
"db.influx.large",
"db.influx.xlarge",
"db.influx.2xlarge",
"db.influx.4xlarge",
"db.influx.8xlarge",
"db.influx.12xlarge",
"db.influx.16xlarge"
]
},
"DbStorageType": {
"Description": "The Timestream for InfluxDB DB storage type to read and write InfluxDB data.",
"Type": "String",
"Default": "InfluxIOIncludedT1",
"AllowedValues": [
"InfluxIOIncludedT1",
"InfluxIOIncludedT2",
"InfluxIOIncludedT3"
]
},
"PubliclyAccessible": {
"Description": "Configures the DB instance with a public IP to facilitate access.",
"Type": "String",
"Default": true,
"AllowedValues": [
true,
false
]
}
},
"Conditions": {
"IsMultiAZ": {
"Fn::Equals": [
{"Ref": "DeploymentType"},
"WITH_MULTIAZ_STANDBY"
]
},
"IsPublic": {
"Fn::Equals": [
{"Ref": "PubliclyAccessible"},
true
]
}
},
"Resources": {
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": {"Ref": "VPCCIDR"}
}
},
"InternetGateway": {
"Type": "AWS::EC2::InternetGateway",
"Condition": "IsPublic"
},
"InternetGatewayAttachment": {
"Type": "AWS::EC2::VPCGatewayAttachment",
"Condition": "IsPublic",
"Properties": {
"InternetGatewayId": {"Ref": "InternetGateway"},
"VpcId": {"Ref": "VPC"}
}
},
"Subnet1": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {"Ref": "VPC"},
"AvailabilityZone": {
"Fn::Select": [
0,
{"Fn::GetAZs": ""}
]
},
"CidrBlock": {
"Fn::Select": [
0,
{
"Fn::Cidr": [
{
"Fn::GetAtt": [
"VPC",
"CidrBlock"
]
},
2,
12
]
}
]
},
"MapPublicIpOnLaunch": {
"Fn::If": [
"IsPublic",
true,
false
]
}
}
},
"Subnet2": {
"Type": "AWS::EC2::Subnet",
"Condition": "IsMultiAZ",
"Properties": {
"VpcId": {"Ref": "VPC"},
"AvailabilityZone": {
"Fn::Select": [
1,
{"Fn::GetAZs": ""}
]
},
"CidrBlock": {
"Fn::Select": [
1,
{
"Fn::Cidr": [
{
"Fn::GetAtt": [
"VPC",
"CidrBlock"
]
},
2,
12
]
}
]
},
"MapPublicIpOnLaunch": {
"Fn::If": [
"IsPublic",
true,
false
]
}
}
},
"RouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {"Ref": "VPC"}
}
},
"DefaultRoute": {
"Type": "AWS::EC2::Route",
"Condition": "IsPublic",
"DependsOn": "InternetGatewayAttachment",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {"Ref": "InternetGateway"}
}
},
"Subnet1RouteTableAssociation": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"SubnetId": {"Ref": "Subnet1"}
}
},
"Subnet2RouteTableAssociation": {
"Type": "AWS::EC2::SubnetRouteTableAssociation",
"Condition": "IsMultiAZ",
"Properties": {
"RouteTableId": {"Ref": "RouteTable"},
"SubnetId": {"Ref": "Subnet2"}
}
},
"InfluxDBSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupName": "influxdb-sg",
"GroupDescription": "Security group allowing port 8086 ingress for InfluxDB",
"VpcId": {"Ref": "VPC"}
}
},
"InfluxDBSecurityGroupIngress": {
"Type": "AWS::EC2::SecurityGroupIngress",
"Properties": {
"GroupId": {"Ref": "InfluxDBSecurityGroup"},
"IpProtocol": "tcp",
"CidrIp": "0.0.0.0/0",
"FromPort": 8086,
"ToPort": 8086
}
},
"InfluxDBLogsS3Bucket": {
"Type": "AWS::S3::Bucket",
"DeletionPolicy": "Retain"
},
"InfluxDBLogsS3BucketPolicy": {
"Type": "AWS::S3::BucketPolicy",
"Properties": {
"Bucket": {"Ref": "InfluxDBLogsS3Bucket"},
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "s3:PutObject",
"Effect": "Allow",
"Resource": {"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}/InfluxLogs/*"},
"Principal": {"Service": "timestream-influxdb.amazonaws.com"}
},
{
"Action": "s3:*",
"Effect": "Deny",
"Resource": [
{"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}/*"},
{"Fn::Sub": "arn:aws:s3:::${InfluxDBLogsS3Bucket}"}
],
"Principal": "*",
"Condition": {
"Bool": {"aws:SecureTransport": false}
}
}
]
}
}
},
"DbInstance": {
"Type": "AWS::Timestream::InfluxDBInstance",
"DependsOn": "InfluxDBLogsS3BucketPolicy",
"Properties": {
"DbStorageType": {"Ref": "DbStorageType"},
"AllocatedStorage": {"Ref": "AllocatedStorage"},
"DbInstanceType": {"Ref": "DbInstanceType"},
"Name": {"Ref": "DbInstanceName"},
"Username": {"Ref": "InfluxDBUsername"},
"Password": {"Ref": "InfluxDBPassword"},
"Organization": {"Ref": "InfluxDBOrganization"},
"Bucket": {"Ref": "InfluxDBBucket"},
"PubliclyAccessible": {
"Fn::If": [
"IsPublic",
true,
false
]
},
"DeploymentType": {"Ref": "DeploymentType"},
"VpcSecurityGroupIds": [
{"Ref": "InfluxDBSecurityGroup"}
],
"VpcSubnetIds": {
"Fn::If": [
"IsMultiAZ",
[
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
],
[
{"Ref": "Subnet1"}
]
]
},
"LogDeliveryConfiguration": {
"S3Configuration": {
"BucketName": {"Ref": "InfluxDBLogsS3Bucket"},
"Enabled": true
}
}
}
}
},
"Outputs": {
"VPC": {
"Description": "A reference to the VPC used to create network resources",
"Value": {"Ref": "VPC"}
},
"Subnets": {
"Description": "A list of the subnets created",
"Value": {
"Fn::If": [
"IsMultiAZ",
{
"Fn::Join": [
",",
[
{"Ref": "Subnet1"},
{"Ref": "Subnet2"}
]
]
},
{"Ref": "Subnet1"}
]
}
},
"Subnet1": {
"Description": "A reference to the subnet in the 1st Availability Zone",
"Value": {"Ref": "Subnet1"}
},
"Subnet2": {
"Condition": "IsMultiAZ",
"Description": "A reference to the subnet in the 2nd Availability Zone",
"Value": {"Ref": "Subnet2"}
},
"InfluxDBSecurityGroup": {
"Description": "Security group with port 8086 ingress rule",
"Value": {"Ref": "InfluxDBSecurityGroup"}
},
"InfluxDBLogsS3Bucket": {
"Description": "S3 Bucket containing InfluxDB logs from the DB instance",
"Value": {"Ref": "InfluxDBLogsS3Bucket"}
},
"DbInstance": {
"Description": "A reference to the Timestream for InfluxDB DB instance",
"Value": {"Ref": "DbInstance"}
},
"InfluxAuthParametersSecretArn": {
"Description": "The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the initial InfluxDB authorization parameters. The secret value is a JSON formatted key-value pair holding InfluxDB authorization values: organization, bucket, username, and password.",
"Value": {
"Fn::GetAtt": [
"DbInstance",
"InfluxAuthParametersSecretArn"
]
}
},
"Endpoint": {
"Description": "The endpoint URL to connect to InfluxDB",
"Value": {
"Fn::Join": [
"",
[
"https://",
{
"Fn::GetAtt": [
"DbInstance",
"Endpoint"
]
},
":8086"
]
]
}
}
}
}
```
### YAML
```
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
-
Label:
default: "Network Configuration"
Parameters:
- VPCCIDR
-
Label:
default: "Amazon Timestream for InfluxDB Configuration"
Parameters:
- DbInstanceName
- InfluxDBUsername
- InfluxDBPassword
- InfluxDBOrganization
- InfluxDBBucket
- DbInstanceType
- DbStorageType
- AllocatedStorage
- PubliclyAccessible
- DeploymentType
ParameterLabels:
VPCCIDR:
default: VPC CIDR
Parameters:
# Network Configuration
VPCCIDR:
Description: Please enter the IP range (CIDR notation) for the new VPC
Type: String
Default: 10.0.0.0/16
# Timestream for InfluxDB Configuration
DbInstanceName:
Description: The name that uniquely identifies the DB instance when interacting with the Amazon Timestream for InfluxDB API and CLI commands. This name will also be a prefix included in the endpoint. DB instance names must be unique per customer and per Region.
Type: String
Default: mydbinstance
MinLength: 3
MaxLength: 40
AllowedPattern: ^[a-zA-z][a-zA-Z0-9]*(-[a-zA-Z0-9]+)*$
# InfluxDB initial user configurations
InfluxDBUsername:
Description: The username of the initial admin user created in InfluxDB. Must start with a letter and can't end with a hyphen or contain two consecutive hyphens. For example, my-user1. This username will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS Secrets Manager in your account.
Type: String
Default: admin
MinLength: 1
MaxLength: 64
InfluxDBPassword:
Description: The password of the initial admin user created in InfluxDB. This password will allow you to access the InfluxDB UI to perform various administrative tasks and also use the InfluxDB CLI to create an operator token. These attributes will be stored in a Secret created in AWS in your account.
Type: String
NoEcho: true
MinLength: 8
MaxLength: 64
AllowedPattern: ^[a-zA-Z0-9]+$
InfluxDBOrganization:
Description: The name of the initial organization for the initial admin user in InfluxDB. An InfluxDB organization is a workspace for a group of users.
Type: String
Default: org
MinLength: 1
MaxLength: 64
InfluxDBBucket:
Description: The name of the initial InfluxDB bucket. All InfluxDB data is stored in a bucket. A bucket combines the concept of a database and a retention period (the duration of time that each data point persists). A bucket belongs to an organization.
Type: String
Default: bucket
MinLength: 2
MaxLength: 64
AllowedPattern: ^[^_\"][^\"]*$
DeploymentType:
Description: Specifies whether the Timestream for InfluxDB is deployed as Single-AZ or with a MultiAZ Standby for High availability
Type: String
Default: WITH_MULTIAZ_STANDBY
AllowedValues:
- SINGLE_AZ
- WITH_MULTIAZ_STANDBY
AllocatedStorage:
Description: The amount of storage to allocate for your DB storage type in GiB (gibibytes).
Type: Number
Default: 400
MinValue: 20
MaxValue: 16384
DbInstanceType:
Description: The Timestream for InfluxDB DB instance type to run InfluxDB on.
Type: String
Default: db.influx.medium
AllowedValues:
- db.influx.medium
- db.influx.large
- db.influx.xlarge
- db.influx.2xlarge
- db.influx.4xlarge
- db.influx.8xlarge
- db.influx.12xlarge
- db.influx.16xlarge
DbStorageType:
Description: The Timestream for InfluxDB DB storage type to read and write InfluxDB data.
Type: String
Default: InfluxIOIncludedT1
AllowedValues:
- InfluxIOIncludedT1
- InfluxIOIncludedT2
- InfluxIOIncludedT3
PubliclyAccessible:
Description: Configures the DB instance with a public IP to facilitate access.
Type: String
Default: true
AllowedValues:
- true
- false
Conditions:
IsMultiAZ: !Equals [!Ref DeploymentType, WITH_MULTIAZ_STANDBY]
IsPublic: !Equals [!Ref PubliclyAccessible, true]
Resources:
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: !Ref VPCCIDR
InternetGateway:
Type: AWS::EC2::InternetGateway
Condition: IsPublic
InternetGatewayAttachment:
Type: AWS::EC2::VPCGatewayAttachment
Condition: IsPublic
Properties:
InternetGatewayId: !Ref InternetGateway
VpcId: !Ref VPC
Subnet1:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
AvailabilityZone: !Select [0, !GetAZs '']
CidrBlock: !Select [0, !Cidr [!GetAtt VPC.CidrBlock, 2, 12 ]]
MapPublicIpOnLaunch: !If [IsPublic, true, false]
Subnet2:
Type: AWS::EC2::Subnet
Condition: IsMultiAZ
Properties:
VpcId: !Ref VPC
AvailabilityZone: !Select [1, !GetAZs '']
CidrBlock: !Select [1, !Cidr [!GetAtt VPC.CidrBlock, 2, 12 ]]
MapPublicIpOnLaunch: !If [IsPublic, true, false]
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
DefaultRoute:
Type: AWS::EC2::Route
Condition: IsPublic
DependsOn: InternetGatewayAttachment
Properties:
RouteTableId: !Ref RouteTable
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
Subnet1RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref Subnet1
Subnet2RouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Condition: IsMultiAZ
Properties:
RouteTableId: !Ref RouteTable
SubnetId: !Ref Subnet2
InfluxDBSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupName: "influxdb-sg"
GroupDescription: "Security group allowing port 8086 ingress for InfluxDB"
VpcId: !Ref VPC
InfluxDBSecurityGroupIngress:
Type: AWS::EC2::SecurityGroupIngress
Properties:
GroupId: !Ref InfluxDBSecurityGroup
IpProtocol: tcp
CidrIp: 0.0.0.0/0
FromPort: 8086
ToPort: 8086
InfluxDBLogsS3Bucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
InfluxDBLogsS3BucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !Ref InfluxDBLogsS3Bucket
PolicyDocument:
Version: '2012-10-17'
Statement:
- Action: "s3:PutObject"
Effect: Allow
Resource: !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}/InfluxLogs/*
Principal:
Service: timestream-influxdb.amazonaws.com
- Action: "s3:*"
Effect: Deny
Resource:
- !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}/*
- !Sub arn:aws:s3:::${InfluxDBLogsS3Bucket}
Principal: "*"
Condition:
Bool:
aws:SecureTransport: false
DbInstance:
Type: AWS::Timestream::InfluxDBInstance
DependsOn: InfluxDBLogsS3BucketPolicy
Properties:
DbStorageType: !Ref DbStorageType
AllocatedStorage: !Ref AllocatedStorage
DbInstanceType: !Ref DbInstanceType
Name: !Ref DbInstanceName
Username: !Ref InfluxDBUsername
Password: !Ref InfluxDBPassword
Organization: !Ref InfluxDBOrganization
Bucket: !Ref InfluxDBBucket
PubliclyAccessible: !If [IsPublic, true, false]
DeploymentType: !Ref DeploymentType
VpcSecurityGroupIds:
- !Ref InfluxDBSecurityGroup
VpcSubnetIds: !If
- IsMultiAZ
-
- !Ref Subnet1
- !Ref Subnet2
-
- !Ref Subnet1
LogDeliveryConfiguration:
S3Configuration:
BucketName: !Ref InfluxDBLogsS3Bucket
Enabled: true
Outputs:
# Network Resources
VPC:
Description: A reference to the VPC used to create network resources
Value: !Ref VPC
Subnets:
Description: A list of the subnets created
Value: !If
- IsMultiAZ
- !Join [",", [!Ref Subnet1, !Ref Subnet2]]
- !Ref Subnet1
Subnet1:
Description: A reference to the subnet in the 1st Availability Zone
Value: !Ref Subnet1
Subnet2:
Condition: IsMultiAZ
Description: A reference to the subnet in the 2nd Availability Zone
Value: !Ref Subnet2
InfluxDBSecurityGroup:
Description: Security group with port 8086 ingress rule
Value: !Ref InfluxDBSecurityGroup
# Timestream for InfluxDB Resources
InfluxDBLogsS3Bucket:
Description: S3 Bucket containing InfluxDB logs from the DB instance
Value: !Ref InfluxDBLogsS3Bucket
DbInstance:
Description: A reference to the Timestream for InfluxDB DB instance
Value: !Ref DbInstance
InfluxAuthParametersSecretArn:
Description: "The Amazon Resource Name (ARN) of the AWS Secrets Manager secret containing the initial InfluxDB authorization parameters. The secret value is a JSON formatted key-value pair holding InfluxDB authorization values: organization, bucket, username, and password."
Value: !GetAtt DbInstance.InfluxAuthParametersSecretArn
Endpoint:
Description: The endpoint URL to connect to InfluxDB
Value: !Join ["", ["https://", !GetAtt DbInstance.Endpoint, ":8086"]]
```
# Menyebarkan tumpukan Windows berbasis menggunakan CloudFormation
Halaman ini menyediakan tautan ke dokumentasi referensi teknis untuk CloudFormation sumber daya yang biasa digunakan dalam penerapan Windows berbasis.
CloudFormation memberikan dukungan untuk menyebarkan dan mengelola Microsoft Windows tumpukan melalui. Infrastructure as Code (IaC) Anda dapat menggunakan CloudFormation untuk penyediaan otomatis instans EC2 Windows berbasis, di SQL Server Amazon RDS, dan melalui. Microsoft Active Directory Directory Service
AWS menyediakan Gambar Mesin Amazon yang telah dikonfigurasi sebelumnya (AMIs) yang dirancang khusus untuk Windows platform untuk membantu Anda menerapkan aplikasi dengan cepat di Amazon EC2. Ini AMIs termasuk Microsoft pengaturan default dan penyesuaian AWS-spesifik. Dengan CloudFormation, Anda dapat memilih AMI yang sesuai, meluncurkan instance, dan mengaksesnya menggunakan Remote Desktop Connection, seperti yang Anda lakukan dengan yang lainWindows Server. Ini AMIs berisi komponen perangkat lunak penting, termasuk EC2Launch (versi bervariasi menurut Windows Server edisi),, AWS Systems Manager, CloudFormation, Alat AWS untuk PowerShell, dan berbagai driver jaringan, penyimpanan, dan grafis untuk memastikan kinerja dan kompatibilitas yang optimal dengan AWS layanan. Untuk informasi selengkapnya, lihat [Referensi AWSWindows AMI](https://docs.aws.amazon.com/ec2/latest/windows-ami-reference/windows-amis.html).
CloudFormation juga mendukung alat konfigurasi perangkat lunak, seperti `UserData` skrip, yang dapat menjalankan PowerShell atau perintah batch ketika instance EC2 pertama kali boot up. Ini juga menawarkan skrip pembantu (`cfn-init`,, `cfn-signal``cfn-get-metadata`, dan`cfn-hup`) dan mendukung `AWS::CloudFormation::Init` metadata untuk mengelola paket, file, dan layanan pada instance. Windows
Untuk lingkungan perusahaan, CloudFormation memungkinkan penggabungan domain, manajemen Windows lisensi melalui model lisensi EC2, dan penanganan kredensi yang aman dengan. AWS Secrets Manager Dikombinasikan dengan template yang dikontrol versi dan penerapan berulang, CloudFormation membantu organisasi mempertahankan lingkungan yang konsisten, aman, dan dapat diskalakan di beberapa akun dan akunWindows. Wilayah AWS
Untuk detail tentang CloudFormation sumber daya yang biasa digunakan dalam penerapan Windows berbasis, lihat topik referensi teknis berikut.
| Tipe sumber daya | Deskripsi |
| --- | --- |
| [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) | Untuk meluncurkan instans Windows EC2. |
| [AWS::EC2::SecurityGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroup.html) | Untuk menentukan aturan firewall untuk Windows beban kerja. |
| [AWS::AutoScaling::AutoScalingKelompok](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-autoscaling-autoscalinggroup.html) [AWS::EC2::LaunchTemplate](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-launchtemplate.html) | Untuk penskalaan instans Windows EC2. |
| [AWS::DirectoryService::MicrosoftIKLAN](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-directoryservice-microsoftad.html) | Untuk menyebarkan MicrosoftActive Directory. |
| [AWS::FSx::FileSystem](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-fsx-filesystem.html) | Untuk menyebarkan FSx untuk Windows File Server. |
| [AWS: :RDS:: DBInstance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html) | Untuk penyediaan di SQL Server Amazon RDS. |
| [AWS::CloudFormation::Init](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-init.html) | Digunakan dalam metadata EC2 untuk mengkonfigurasi instance. Untuk informasi selengkapnya, lihat [Tumpukan berbasis bootstrap Windows CloudFormation](cfn-windows-stacks-bootstrapping.md). |
| [AWS::SecretsManager::Secret](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-secretsmanager-secret.html) | Untuk mengelola kredensi dan kata sandi dengan aman. Windows |
| [AWS::SSM::Parameter](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-parameter.html) | Untuk menyimpan nilai konfigurasi dengan aman. |
| [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-instanceprofile.html) [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html) | Untuk memberikan izin ke aplikasi yang berjalan pada instans EC2. |
# Tumpukan berbasis bootstrap Windows CloudFormation
Topik ini menjelaskan cara mem-bootstrap Windows tumpukan dan memecahkan masalah pembuatan tumpukan.
**Topics**
+ [Data pengguna dalam instans EC2](#cfn-windows-bootstrapping-user-data)
+ [CloudFormation skrip pembantu](#cfn-windows-bootstrapping-helper-scripts)
+ [Contoh bootstrap tumpukan Windows](#cfn-windows-bootstrapping-example)
+ [Melarikan diri dari garis miring terbalik di jalur file Windows](#cfn-windows-stacks-escape-backslashes)
+ [Kelola Windows layanan](#cfn-windows-stacks-manage-windows-services)
+ [Memecahkan masalah pembuatan tumpukan](#cfn-windows-stacks-troubleshooting)
## Data pengguna dalam instans EC2
Data pengguna adalah fitur Amazon EC2 yang memungkinkan Anda meneruskan skrip atau informasi konfigurasi ke instans EC2 saat diluncurkan.
Untuk instans Windows EC2:
+ Anda dapat menggunakan skrip batch (menggunakan `