AWS CloudFormation YAML配置异常求助：与设计器预期不符

学习AWS CloudFormation时，编写的YAML模板部署后，栈的实际结果与CloudFormation设计器的预期不符，怀疑是引用问题（已尝试!Ref和长格式Ref但无改善），以下是具体排查方向：

先修复模板中的明显语法/配置错误 #

1. InternetGatewayAttachment的网关ID引用错误 #

InternetGatewayAttachment中InternetGatewayId直接写了资源名称InternetGateway，未使用引用语法，CloudFormation无法识别有效网关ID，会导致网关无法挂载到VPC：
错误代码：

InternetGatewayId: InternetGateway

修正后：

InternetGatewayId: !Ref InternetGateway

2. FileServerSG的Tags格式错误 #

FileServerSG的Tags未使用数组格式（缺少开头的-），会导致CloudFormation解析异常，可能影响资源关联展示：
错误代码：

Tags:
    Key: Name
    Value: DE-Extract-FileServerSG

修正后：

Tags:
  - Key: Name
    Value: DE-Extract-FileServerSG

3. FileGatewaySG缺少Tags配置 #

虽然不影响核心功能，但格式不一致可能导致设计器解析展示异常，建议补充与其他安全组一致的Tags数组配置：
补充代码示例：

Tags:
  - Key: Name
    Value: DE-Extract-FileGatewaySG

资源关联与依赖排查 #

• 检查安全组的VPC关联状态：在AWS控制台EC2安全组页面，确认三个安全组是否确实关联到创建的VPC中。如果未关联，查看CloudFormation栈事件日志，确认安全组创建时是否有报错。
• 验证资源依赖关系：虽然安全组通过VpcId: !Ref VPC指定了关联，但极端情况下可尝试给安全组添加DependsOn: VPC明确依赖（通常Ref会自动处理依赖，但手动指定可排除依赖解析问题）。

CloudFormation设计器本身问题排查 #

• 刷新或重新导入模板：设计器可能存在缓存，尝试刷新页面，或者将修正后的模板重新导入设计器查看展示效果。
• 转换为JSON格式验证：将YAML模板转换为JSON格式后导入设计器，若展示正常则说明是YAML格式解析的细节问题。

修正后的完整YAML模板 #

Parameters: 
   EnvironmentName:
      Description: An environment name that is prefixed to resource names
      Type: String
      Default: DE-Extract
      
   VpcCIDR:
      Description: Please enter the IP range (CIDR notation) for this VPC
      Type: String
      Default: 192.168.0.0/16
    
   DataCenterPublicSubnetCIDR:
      Description: Please enter the IP range (CIDR notation) for the public subnet in the first Availability Zone
      Type: String
      Default: 192.168.10.0/24
    
Resources:
   VPC:
      Type: AWS::EC2::VPC
      Properties:
         CidrBlock: 
            Ref: VpcCIDR
         EnableDnsSupport: 'true'
         EnableDnsHostnames: 'true'
         Tags:
           - Key: Name
             Value: 
                Ref: EnvironmentName

   InternetGateway:
      Type: AWS::EC2::InternetGateway
      Properties:
         Tags:
            - Key: Name
              Value: 
                 Ref: EnvironmentName

   InternetGatewayAttachment:
      Type: AWS::EC2::VPCGatewayAttachment
      Properties:
         InternetGatewayId: !Ref InternetGateway
         VpcId: 
            Ref: VPC

   DataCenterPublicSubnet:
      Type: AWS::EC2::Subnet
      Properties:
         VpcId: 
            Ref: VPC
         CidrBlock: 
            Ref: DataCenterPublicSubnetCIDR
         AvailabilityZone: !Select [0, !GetAZs '']
         MapPublicIpOnLaunch: true
         Tags:
            - Key: Name
              Value: DE-Extract Data Center Subnet

   PublicRouteTable:
      Type: AWS::EC2::RouteTable
      Properties:
         VpcId: 
            Ref: VPC
         Tags:
          - Key: Name
            Value: DE-Extract Public Routes

   DefaultPublicRoute:
      Type: AWS::EC2::Route
      DependsOn: InternetGatewayAttachment
      Properties:
         RouteTableId: 
            Ref: PublicRouteTable
         DestinationCidrBlock: 0.0.0.0/0
         GatewayId: 
            Ref: InternetGateway

   DataCenterPublicSubnetRouteTableAssociation:
      Type: AWS::EC2::SubnetRouteTableAssociation
      Properties:        
         SubnetId: 
            Ref: DataCenterPublicSubnet
         RouteTableId: 
            Ref: PublicRouteTable 
 
   WindowsInstanceSG:
      Type: AWS::EC2::SecurityGroup
      Properties:
         VpcId: 
            Ref: VPC
         GroupName: DE-Extract-WindowsInstanceSG
         GroupDescription: This group permits RDP access to an instance deployed within the public subnet of the VPC.
         SecurityGroupIngress:
            - IpProtocol: tcp
              CidrIp: 0.0.0.0/0
              FromPort: 3389
              ToPort: 3389
         Tags:
          - Key: Name
            Value: DE-Extract-WindowsInstanceSG

   FileServerSG:
      Type: AWS::EC2::SecurityGroup
      Properties:
         VpcId: 
            Ref: VPC
         GroupName: DE-Extract-FileServerSG
         GroupDescription: is responsible for permitting ssh access to the data center's file server from an internal source within the VPC.
         SecurityGroupIngress:
            - IpProtocol: tcp
              CidrIp: 192.168.10.0/24
              FromPort: 22
              ToPort: 22  
         Tags:
            - Key: Name
              Value: DE-Extract-FileServerSG

   FileGatewaySG:
      Type: AWS::EC2::SecurityGroup
      Properties:
         VpcId: 
            Ref: VPC
         GroupName: DE-Extract-FileGatewaySG
         GroupDescription: This security group controls the access to the file gateway instance configured later on
         SecurityGroupIngress:
            - IpProtocol: tcp
              CidrIp: 192.168.0.0/16
              FromPort: 1
              ToPort: 65534     
         Tags:
            - Key: Name
              Value: DE-Extract-FileGatewaySG

内容的提问来源于stack exchange，提问作者suchasage