CloudFormation栈创建时cfn-init与cfn-signal超时问题求助

问题背景 #

我的EC2Instance资源的UserData配置如下：

#!/bin/bash
apt-get update -y
apt-get -y install python3-pip
mkdir -p /opt/aws/
pip3 install https://s3.amazonaws.com/cloudformation-examples/aws-cfn-bootstrap-py3-latest.tar.gz
ln -s /usr/local/init/ubuntu/cfn-hup /etc/init.d/cfn-hup
/usr/local/bin/cfn-init -v --stack ${AWS::StackId} --resource EC2Instance --configsets server_install --region ${AWS::Region}
/usr/local/bin/cfn-signal -e $? --stack ${AWS::StackId} --resource EC2Instance --region ${AWS::Region}

执行栈创建时，cfn-init和cfn-signal命令执行失败，EC2实例未安装AWS::CloudFormation::Init配置的任何软件包。

排查信息（未设置失败回滚/未启用失败信号，故能登录实例） #

/var/log/cloud-init.log日志 #

2023-04-12 21:17:17,121 - subp.py[DEBUG]: Running command 
['/var/lib/cloud/instance/scripts/part-001'] with allowed return codes [0] (shell=False, capture=False)
2023-04-12 21:28:34,625 - subp.py[DEBUG]: Unexpected error while running command.
Command: ['/var/lib/cloud/instance/scripts/part-001']
Exit code: 1
Reason: -
Stdout: -
Stderr: -
2023-04-12 21:28:34,629 - cc_scripts_user.py[WARNING]: Failed to run module scripts-user (scripts in /var/lib/cloud/instance/scripts)

/var/lib/cloud/instance/scripts/part-001 #

内容与CF模板中的UserData部分完全一致

/var/log/cloud-init-output.log日志（翻译后） #

2023-04-12 21:18:06,101 [DEBUG] CloudFormation客户端已初始化，端点为https://cloudformation.us-east-1.amazonaws.com
2023-04-12 21:18:06,102 [DEBUG] 正在描述栈arn:aws:cloudformation:us-east-1:<accountId>:stack/<app-name>/<uuid>中的资源EC2Instance
2023-04-12 21:19:06,102 [WARNING] 已超过60秒超时时间
2023-04-12 21:19:06,103 [ERROR] 客户端超时
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/dist-packages/cfnbootstrap/util.py", line 193, in _retry
    return f(*args, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/cfnbootstrap/util.py", line 266, in _timeout
    raise TimeoutError(
cfnbootstrap.util.TimeoutError


2023-04-12 21:18:06,101 [DEBUG] CloudFormation客户端已初始化，端点为https://cloudformation.us-east-1.amazonaws.com
2023-04-12 21:18:06,102 [DEBUG] 正在向栈arn:aws:cloudformation:us-east-1:<accountId>:stack/<app-name>/<uuid>中的资源EC2Instance发送信号
2023-04-12 21:19:06,102 [WARNING] 已超过60秒超时时间
2023-04-12 21:19:06,103 [ERROR] 客户端超时
Traceback (most recent call last):
  File "/usr/local/lib/python3.10/dist-packages/cfnbootstrap/util.py", line 193, in _retry
    return f(*args, **kwargs)
  File "/usr/local/lib/python3.10/dist-packages/cfnbootstrap/util.py", line 266, in _timeout
    raise TimeoutError(
cfnbootstrap.util.TimeoutError

排查与修复步骤 #

1. 验证网络连通性
   在EC2实例上执行以下命令测试是否能访问CloudFormation端点：

   curl -v https://cloudformation.us-east-1.amazonaws.com
   

   若无法连通，检查安全组出站规则是否允许443端口流量到AWS服务，或网络ACL是否放行对应流量。

2. 延长命令超时时间
   修改cfn-init和cfn-signal命令，添加--timeout参数延长超时时间（示例设置为300秒）：

   /usr/local/bin/cfn-init -v --timeout 300 --stack ${AWS::StackId} --resource EC2Instance --configsets server_install --region ${AWS::Region}
   /usr/local/bin/cfn-signal -e $? --timeout 300 --stack ${AWS::StackId} --resource EC2Instance --region ${AWS::Region}
   

3. 确认IAM角色权限
   检查EC2实例关联的IAM角色是否包含以下权限：

   • cloudformation:DescribeStackResource
   • cloudformation:SignalResource
     若缺少，更新IAM角色的权限策略。

4. 确保网络就绪后再执行命令
   在UserData中添加网络等待逻辑，避免实例刚启动时网络未就绪导致超时：

   # 等待CloudFormation端点可达
   until curl -sf https://cloudformation.us-east-1.amazonaws.com; do
       sleep 5
   done
   

   将这段代码放在执行cfn-init之前。

内容的提问来源于stack exchange，提问作者neuquen