AWS CloudFormation部署报错：ImageID问题排查求助

学习AWS已有两个月，使用CloudFormation YAML模板部署应用时失败，CloudFormation事件提示错误源于ImageID，但无法定位问题。已尝试调整模板格式，并使用命令aws cloudformation validate-template --template-body file:///home/ec2-user/environment/CFTemplatesRepo/templates/cafe-app.yaml进行调试，以下是模板代码：

AWSTemplateFormatVersion: 2010-09-09
Description: Cafe application

Parameters:

  InstanceTypeParameter:
    Type: String
    Default: t2.small
    AllowedValues:
      - t2.micro
      - t2.small
      - t3.micro
      - t3.small
    Description: Default is t2.small. Choose t2.micro, t2.small, t3.small or t3.micro.

  LatestAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'

  CafeNetworkParameter:
    Type: String
    Default: update-cafe-network

Mappings:

  RegionMap:
    us-east-1:
      "keypair": "vockey"
    us-west-2:
      "keypair": "cafe-oregon"

Resources:

  CafeSG:
      Type: 'AWS::EC2::SecurityGroup'
      Properties:
        GroupDescription: Enable SSH, HTTP access
        VpcId: !ImportValue
          'Fn::Sub': '${CafeNetworkParameter}-VpcID'
        Tags:
          - Key: Name
            Value: CafeSG
        SecurityGroupIngress:
          - IpProtocol: tcp
            FromPort: '80'
            ToPort: '80'
            CidrIp: 0.0.0.0/0
          - IpProtocol: tcp
            FromPort: '22'
            ToPort: '22'
            CidrIp: 0.0.0.0/0
  
  CafeInstance:
    Type: 'AWS::EC2::Instance'
    InstanceType: !Ref InstanceTypeParameter
    Properties:
      ImageID: !Ref LatestAmiId
      IamInstanceProfile: "CafeRole"
      KeyName: !FindInMap [RegionMap, !Ref "AWS::Region", keypair]
      NetworkInterfaces:
        - DeviceIndex: '0'
          AssociatePublicIpAddress: true
          SubnetId: !ImportValue
            'Fn::Sub': '${CafeNetworkParameter}-SubnetID'
          GroupSet:
            - !Ref CafeSG
      Tags:
      - Key: Name
        Value: Cafe Web Server

      UserData:
          Fn::Base64:
            !Sub |
              #!/bin/bash
              yum -y update
              yum install -y httpd mariadb-server wget
              amazon-linux-extras install -y lamp-mariadb10.2-php7.2 php7.2
              systemctl enable httpd
              systemctl start httpd
              systemctl enable mariadb
              systemctl start mariadb
              wget https://aws-tc-largeobjects.s3.us-west-2.amazonaws.com/CUR-TF-200-ACACAD-2-16750/14-lab-mod10-challenge-CFn/s3/cafe-app.sh
              chmod +x cafe-app.sh
              ./cafe-app.sh

Outputs:
  WebServerPublicIP:
    Value: !GetAtt 'CafeInstance.PublicIp'

排查要点及解决方案 #

• 属性名大小写错误：CloudFormation对资源属性名大小写敏感，EC2 Instance资源中你写的是ImageID，正确的属性名应为ImageId（d小写）。这是导致ImageID相关错误的最直接原因，修正后即可解决大部分此类问题。修正后的代码片段：

  CafeInstance:
    Type: 'AWS::EC2::Instance'
    InstanceType: !Ref InstanceTypeParameter
    Properties:
      ImageId: !Ref LatestAmiId  # 修正大小写
      IamInstanceProfile: "CafeRole"
      # 其他属性保持不变
  

• SSM参数区域兼容性：确认当前部署的AWS区域是否支持默认的SSM参数/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2。部分区域可能没有该参数，或者需要根据实例架构选择对应AMI参数（比如ARM架构需用amzn2-ami-hvm-arm64-gp2）。可通过aws ssm get-parameter --name "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2" --region <你的区域>命令验证参数是否存在。

• IAM权限验证：检查执行CloudFormation部署的IAM实体（用户/角色）是否拥有ssm:GetParameter权限，若权限不足，将无法读取SSM参数中的AMI ID，导致ImageID错误。需在IAM策略中添加对应权限。

• 依赖资源存在性：确认CafeRole实例配置文件、导入的VPC/子网资源在当前账户中已创建，若依赖资源缺失，也可能引发部署失败，需逐一排除此类问题。

内容的提问来源于stack exchange，提问作者Patri