如何通过CloudFormation将EC2 StopInstances API设为EventBridge目标

尝试编写CloudFormation模板创建EventBridge规则，按计划停止EC2实例，但配置目标时因ARN格式错误失败。相关模板片段及错误信息如下：

错误模板片段 #

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        ...
        "Ec2StartStopRule": {
            "Type": "AWS::Events::Rule",
            "Properties": {
                "Name": "ec2-stop-start-rule",
                "RoleArn": {
                    "Fn::GetAtt": [
                        "Ec2StopStartRoleForEventBridge",
                        "Arn"
                    ]
                },
                "ScheduleExpression": "cron(0 12 * * ? *)",
                "Targets": [
                    {
                        "Arn": "ec2:StopInstances",
                        "Id": "Id1234",
                        "RunCommandParameters": {
                            "RunCommandTargets": [
                                {
                                    "Key": "InstanceIds",
                                    "Values": [
                                        "mydata"
                                    ]
                                }
                            ]
                        },
                        "RetryPolicy": {
                            "MaximumRetryAttempts": 2,
                            "MaximumEventAgeInSeconds": 3600
                        }
                    }
                ]
            }
        }
    }
}

错误提示 #

参数ec2:StopInstances无效。原因：提供的ARN格式不正确。

1. 修正EC2服务ARN格式 #

调用EC2 API作为EventBridge目标时，必须使用EC2服务的标准ARN格式，格式为：

arn:aws:ec2:<区域>:<账户ID>:*

也可以使用通用格式（CloudFormation会自动填充当前区域和账户ID）：

arn:aws:ec2:*:*:*

2. 替换错误的参数配置 #

RunCommandParameters是用于SSM Run Command目标的配置项，调用EC2 API需要改用Input字段传递API参数，指定要停止的实例ID。

3. 确保执行角色权限合规 #

EventBridge的执行角色需要具备ec2:StopInstances权限，且信任策略需允许events.amazonaws.com扮演该角色。

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Resources": {
        "Ec2StopStartRoleForEventBridge": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Version": "2012-10-17",
                    "Statement": [
                        {
                            "Effect": "Allow",
                            "Principal": {
                                "Service": "events.amazonaws.com"
                            },
                            "Action": "sts:AssumeRole"
                        }
                    ]
                },
                "Policies": [
                    {
                        "PolicyName": "Ec2StopPolicy",
                        "PolicyDocument": {
                            "Version": "2012-10-17",
                            "Statement": [
                                {
                                    "Effect": "Allow",
                                    "Action": "ec2:StopInstances",
                                    "Resource": "arn:aws:ec2:*:*:instance/<你的实例ID>"
                                }
                            ]
                        }
                    }
                ]
            }
        },
        "Ec2StartStopRule": {
            "Type": "AWS::Events::Rule",
            "Properties": {
                "Name": "ec2-stop-start-rule",
                "RoleArn": {
                    "Fn::GetAtt": [
                        "Ec2StopStartRoleForEventBridge",
                        "Arn"
                    ]
                },
                "ScheduleExpression": "cron(0 12 * * ? *)",
                "Targets": [
                    {
                        "Arn": "arn:aws:ec2:*:*:*",
                        "Id": "StopEC2InstanceTarget",
                        "Input": "{\"InstanceIds\": [\"<你的实例ID>\"]}",
                        "RetryPolicy": {
                            "MaximumRetryAttempts": 2,
                            "MaximumEventAgeInSeconds": 3600
                        }
                    }
                ]
            }
        }
    }
}

关键说明 #

• 将<你的实例ID>替换为实际需要停止的EC2实例ID，也可通过CloudFormation参数实现动态传入。
• 角色权限中的Resource可指定具体实例ID，或使用*允许停止所有实例（根据业务需求调整）。
• Input字段的JSON内容必须严格匹配EC2 StopInstances API的参数格式。

内容的提问来源于stack exchange，提问作者Halil