通过CloudFormation创建ALB时遇Security group 'ALB-sg'无效错误求助

问题场景 #

使用CloudFormation创建应用负载均衡器（ALB）时，收到以下错误：

Security group 'ALB-sg' is not valid（Service: AmazonElasticLoadBalancing; Status Code: 400; Error Code: ValidationError; Request ID: 6ec8a268-80cc-4a3e-9477-809dba8a00c7; Proxy: null）

错误原因 #

分析提供的CloudFormation模板，问题出在以下两点：

1. 安全组未关联目标VPC：Albsg资源没有指定VpcId属性，导致安全组默认创建在AWS账户默认VPC中。而ALB部署在参数指定的VPC对应的子网里，跨VPC的安全组无法被ALB引用，触发验证错误。
2. 端口参数类型不规范：SecurityGroupIngress中的FromPort和ToPort使用了字符串类型（'80'），虽然CloudFormation可能兼容，但严格来说应该使用数字类型，避免潜在解析问题。

修复步骤 #

1. 给Albsg资源添加VpcId属性，关联到模板参数中的VPC，确保安全组与ALB在同一VPC内。
2. 将FromPort和ToPort的字符串值'80'改为数字80，符合CloudFormation参数类型要求。

完整修正后的模板 #

AWSTemplateFormatVersion: 2010-09-09

Description: AWS CloudFormation Sample Template for creating LoadBalancer

Parameters:
  VPC:
    Description: VPCId of your existing Virtual Private Cloud (VPC)
    Type: String
    Default: vpc-0c9a732125ac08541
  
  PublicSubnet:
    Description: SubnetId of an existing subnet (for the primary network in your Virtual Private Cloud VPC)
    Type: String
    Default: subnet-0787f34404852ceb9

Resources:
  
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties: 
      Name: MyApplicationLoadBalancer
      Type: application
      IpAddressType: ipv4
      Scheme: internet-facing
      SecurityGroups: 
        - !Ref Albsg 
      Subnets: 
        - !Ref PublicSubnet
      Tags:
        - Key: Name
          Value: ALB

  HTTPListener:
        Type: "AWS::ElasticLoadBalancingV2::Listener"
        Properties:
            LoadBalancerArn: !Ref ApplicationLoadBalancer
            Port: 80
            Protocol: "HTTP"
            DefaultActions: 
              - Type: forward
                TargetGroupArn: !Ref ALBTargetGroup
  
  
  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      HealthCheckIntervalSeconds: 10
      HealthCheckPath: /
      HealthCheckTimeoutSeconds: 5
      HealthyThresholdCount: 2
      Matcher:
        HttpCode: 200,302
      Name: MyWebServers
      Port: 80
      Protocol: HTTP
      TargetType: instance
      UnhealthyThresholdCount: 5
      VpcId: !Ref VPC
      

  Albsg:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupName: ALB-sg
      GroupDescription: Security group for Load balancer
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          FromPort: 80
          IpProtocol: tcp
          ToPort: 80
      Tags:
        - Key: Name 
          Value: ALB_SG

Outputs:
  TargetGroupName:
    Value: !Ref ALBTargetGroup
    Description: Name of Target ARN

内容的提问来源于stack exchange，提问作者Geralt