使用CloudFormation创建EC2部署Tomcat时遇参数冲突错误

错误信息：

The parameter groupName cannot be used with the parameter subnet (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: dce48dfe-24dc-48a8-a875-5b9148e8f864; Proxy: null)

尝试通过CloudFormation创建一台部署Tomcat的EC2实例，使用的模板如下：

AWSTemplateFormatVersion: 2010-09-09

Description: This Template Create an EC2 in private subnet.

Parameters: 
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: String
    Default: demo

  VPCId:
    Description: VpcId of your existing Virtual Private Cloud (VPC)
    Type: String
    Default: vpc-0c9a732125ac08541 

  PrivateSubnetId:
    Description: SubnetId of an existing subnet (for the primary network in your Virtual Private Cloud VPC)
    Type: String
    Default: subnet-062e25e97c1645a2b

Resources:
  TomcatInstance:
    Type: 'AWS::EC2::Instance'  
    Properties:
      KeyName: !Ref KeyName
      SecurityGroups:
        - !Ref TomcatSecurityGroup
        - !Ref TomcatCustomTCPSecurityGroup
      UserData:
        Fn::Base64:    
          #!/bin/bash
          sudo yum install java -y
          req_tom_ver= 10.0.27
          tom_m_v=$(echo $req_tom_ver|cut -c 1,2)
          URL= https://dlcdn.apache.org/tomcat/tomcat-${tom_m_v}/v${req_tom_ver}/bin/apache-tomcat-${req_tom_ver}.tar.gz
          wget $URL
          sudo tar -xvzf apache-tomcat-${req_tom_ver}.tar.gz
          sudo mv apache-tomcat-${req_tom_ver} tomcat${tom_m_v}
          sudo rm -rf apache-tomcat-${req_tom_ver}.tar.gz
          sudo chmod 700 /tomcat${tom_m_v}/bin/*.sh
          cd /tomcat${tom_m_v}/bin
          sudo ./startup.sh
      AvailabilityZone: us-east-1a
      ImageId: ami-0aa7d40eeae50c9a9
      InstanceType: t2.micro
      SubnetId: !Ref PrivateSubnetId
      

  TomcatSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCId
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp:  0.0.0.0/0

  TomcatCustomTCPSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCId
      GroupDescription: Enable tomcat access via port 8080
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '8080'
          ToPort: '8080'
          CidrIp:  0.0.0.0/0

错误核心原因 #

当EC2实例部署在VPC的子网中时，必须使用SecurityGroupIds属性指定安全组；而SecurityGroups是用于EC2经典网络（非VPC环境）的参数，和SubnetId同时使用会触发参数冲突。

修复步骤 #

1. 在TomcatInstance的Properties中，将SecurityGroups替换为SecurityGroupIds
2. 同时修正UserData脚本中的语法错误（变量赋值空格、路径缺失），避免Tomcat部署失败

修改后的TomcatInstance资源代码：

TomcatInstance:
  Type: 'AWS::EC2::Instance'  
  Properties:
    KeyName: !Ref KeyName
    SecurityGroupIds:  # 替换为VPC环境下的安全组ID参数
      - !Ref TomcatSecurityGroup
      - !Ref TomcatCustomTCPSecurityGroup
    UserData:
      Fn::Base64:    
        #!/bin/bash
        sudo yum install java -y
        req_tom_ver=10.0.27  # 移除赋值空格，避免脚本语法错误
        tom_m_v=$(echo $req_tom_ver|cut -c 1,2)
        URL=https://dlcdn.apache.org/tomcat/tomcat-${tom_m_v}/v${req_tom_ver}/bin/apache-tomcat-${req_tom_ver}.tar.gz  # 移除赋值空格
        wget $URL
        sudo tar -xvzf apache-tomcat-${req_tom_ver}.tar.gz
        sudo mv apache-tomcat-${req_tom_ver} /tomcat${tom_m_v}  # 补充根目录路径，确保Tomcat安装到正确位置
        sudo rm -rf apache-tomcat-${req_tom_ver}.tar.gz
        sudo chmod 700 /tomcat${tom_m_v}/bin/*.sh
        cd /tomcat${tom_m_v}/bin
        sudo ./startup.sh
    AvailabilityZone: us-east-1a
    ImageId: ami-0aa7d40eeae50c9a9
    InstanceType: t2.micro
    SubnetId: !Ref PrivateSubnetId

内容的提问来源于stack exchange，提问作者Geralt