使用AWS CDK创建EC2实例后无法执行命令的问题

问题核心原因 #

代码中存在两处关键错误导致预设命令无法正常执行：

1. UserData关联逻辑错误：创建EC2实例时先指定了初始自定义UserData，后续新建的UserData对象通过instance.user_data.add_commands(str(user_data))添加，这会将UserData对象的序列化字符串（包含多余元数据头）写入脚本，导致系统无法正确解析命令。
2. 脚本命令存在缺陷：apt install git未添加-y参数，会触发交互式确认中断执行；cd <folder_path>未判断路径是否存在，若克隆后的目录名不符会导致后续命令直接失败。

修复后的完整代码 #

from aws_cdk import (
    Stack,
    aws_ec2 as ec2,
    CfnOutput,
    aws_iam as iam,
)
from constructs import Construct

class CdkTrsting1Stack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

        # VPC（替换为实际VPC和子网ID）
        vpc = ec2.Vpc.from_vpc_attributes(
            self, "VPC",
            vpc_id="vpc-xxxxxx",
            availability_zones=['us-east-1a'],
            public_subnet_ids=['subnet-xxxxxx']
        )

        # 安全组配置
        security_group = ec2.SecurityGroup(
            self, "SecurityGroup",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="AllowAllInbound",
        )
        security_group.add_ingress_rule(ec2.Peer.any_ipv4(), ec2.Port.tcp(22))
        security_group.add_ingress_rule(ec2.Peer.any_ipv4(), ec2.Port.tcp(80))
        security_group.add_ingress_rule(ec2.Peer.any_ipv4(), ec2.Port.tcp(443))

        # IAM角色配置
        role = iam.Role(
            self, "EC2FullAccessRole",
            assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"),
        )
        role.add_to_policy(iam.PolicyStatement(
            actions=["ec2:*"],
            resources=["*"]
        ))

        # 构建正确的Linux UserData脚本
        user_data = ec2.UserData.for_linux()
        user_data.add_commands(
            "#!/bin/bash",
            # 重定向输出到日志文件，方便排查
            "exec > /var/log/user-data-exec.log 2>&1",
            "echo '开始执行UserData脚本...'",
            "sudo apt update -y && sudo apt upgrade -y",
            "sudo apt install git -y",
            "git clone <git_url>",
            # 增加目录存在性判断，避免路径错误中断脚本
            "if [ -d '<folder_path>' ]; then",
            "    cd <folder_path>",
            "    sh startup_run.sh",
            "    echo '脚本执行完成'",
            "else",
            "    echo '错误：目标目录不存在'",
            "fi"
        )

        # 创建EC2实例并绑定正确的UserData
        instance = ec2.Instance(
            self,
            "MyInstance",
            instance_type=ec2.InstanceType("t2.micro"),
            machine_image=ec2.MachineImage.generic_linux({
                "us-east-1": "ami-07d9b9ddc6cd8dd30"
            }),
            vpc=vpc,
            security_group=security_group,
            associate_public_ip_address=True,
            key_name="<key>",
            role=role,
            user_data=user_data  # 直接关联正确的UserData对象
        )

        # 输出实例信息
        CfnOutput(self, "InstanceId", value=instance.instance_id)
        CfnOutput(self, "InstanceIp", value=instance.instance_public_dns_name)

验证方法 #

部署修复后的代码后，通过SSH登录EC2实例，查看以下日志确认脚本执行状态：

• 查看cloud-init初始化日志：cat /var/log/cloud-init.log
• 查看自定义脚本输出日志：cat /var/log/user-data-exec.log

内容的提问来源于stack exchange，提问作者Mohil