CloudFormation栈创建失败：资源未生成及导出导入错误求助

核心错误点 #

• VPC栈资源创建失败：模板存在依赖缺失、输出配置错误
• EC2栈导入导出不匹配：导出项命名混乱、导入资源类型错误、变量引用错误

具体错误拆解与修复 #

1. VPC模板问题修复 #

问题明细

• MySecurityGroup未指定VpcId，默认创建在默认VPC，导致资源依赖混乱
• 输出项命名与实际值完全不匹配（如用安全组ID导出却命名为VPCID）
• 属性引用语法错误：!Ref MySecurityGroup.GroupId是非法写法，需用!GetAtt获取资源属性

修复后的VPC.yaml：

Parameters:
  VPCName:
    Default: "VPC"
    Type: String
    Description: VPC名称

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Ref VPCName
  MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: MyVPC
    Properties:
      GroupDescription: 开放80端口
      VpcId: !Ref MyVPC  # 指定安全组归属的自定义VPC
      SecurityGroupIngress: 
        - FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          IpProtocol: tcp

  SGPing:
    Type: AWS::EC2::SecurityGroup
    DependsOn: MyVPC
    Properties:
      GroupDescription: 用于测试Ping的安全组
      VpcId: !Ref MyVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 10.0.0.0/24
        - IpProtocol: icmp
          FromPort: 8
          ToPort: -1
          CidrIp: 10.0.0.0/24

Outputs:
  SGPingID:
    Value: !Ref SGPing
    Export:
      Name: !Sub "${AWS::StackName}-SGPingID"

  MySecurityGroupID:
    Value: !Ref MySecurityGroup
    Export:
      Name: !Sub "${AWS::StackName}-MySecurityGroupID"

  MySecurityGroupGroupId:
    Value: !GetAtt MySecurityGroup.GroupId
    Export: !Sub "${AWS::StackName}-MySecurityGroupGroupId"

2. EC2模板问题修复 #

问题明细

• SubnetId导入安全组ID，资源类型完全不匹配
• 引用变量错误：用当前EC2栈的AWS::StackName代替VPC栈的VPCStackName参数
• 缺少子网资源：VPC模板未创建子网，EC2实例无法指定子网部署

修复后的EC2.yaml：

Parameters:
  VPCStackName:
    Default: "VPC"
    Type: String
    Description: VPC栈的名称

Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-06dd92ecc74fdfb36  # 该AMI仅在eu-central-1区域可用，换区需替换
      KeyName: aloho
      SubnetId: 
        Fn::ImportValue:
          !Sub "${VPCStackName}-PublicSubnetID"  # 导入VPC栈的子网ID
      SecurityGroupIds:
        - Fn::ImportValue:
            !Sub "${VPCStackName}-MySecurityGroupID"
        - Fn::ImportValue:
            !Sub "${VPCStackName}-SGPingID"

      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum install -y nginx
          echo "Hello from EC2 Instance" > /usr/share/nginx/html/index.html

补充：VPC模板需添加子网资源（必加） #

EC2实例必须部署在子网内，需在VPC模板的Resources和Outputs中添加以下内容：

# 添加到VPC模板的Resources节点下
  PublicSubnet:
    Type: AWS::EC2::Subnet
    DependsOn: MyVPC
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: "10.0.1.0/24"
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: !Sub "${VPCName}-PublicSubnet"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${VPCName}-IGW"

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MyVPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: AttachGateway
    Properties:
      VpcId: !Ref MyVPC
      Tags:
        - Key: Name
          Value: !Sub "${VPCName}-PublicRouteTable"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

# 添加到VPC模板的Outputs节点下
  PublicSubnetID:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub "${AWS::StackName}-PublicSubnetID"

部署流程 #

1. 删除已失败的EC2栈和VPC栈
2. 部署修复后的VPC栈，确认所有资源创建成功
3. 部署修复后的EC2栈，指定正确的VPCStackName参数（即VPC栈的部署名称）

内容的提问来源于stack exchange，提问作者HAKURSAL