Elastic Beanstalk部署高可用WordPress时EFS挂载及安全组报错排查

• 部署场景：在Elastic Beanstalk上部署对接外部RDS、EFS的高可用WordPress应用，核心故障表现为EFS挂载失败、无法将WordPress代码存储至EFS，全流程部署无法完成。
• 已执行操作：根据自身基础设施架构，修改了.ebextensions配置目录下EFS创建、挂载脚本中的VPC、子网相关参数，部署仍失败。

2022-06-08 11:41:19 UTC+0530 ERROR: Deleting security group named: awseb-e-umh3prditb-stack-loadbalancersg-3H8HOI31196I failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 3ccc1932-36f8-4170-a914-cc39b3908843; Proxy: null)
2022-06-08 11:41:18 UTC+0530 ERROR: Deleting security group named: awseb-e-umh3prditb-stack-MountTargetSecurityGroup-1X6EEF17U2MYO failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 703da33a-bca6-419c-a148-674b144b2cd5; Proxy: null)
2022-06-08 11:38:22 UTC+0530 WARN: Environment health has transitioned from Ok to Warning. Application update is aborting (running for 35 seconds).
2022-06-08 11:38:15 UTC+0530 ERROR: Deleting security group named: awseb-e-umh3prditb-stack-loadbalancersg-3H8HOI31196I failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 0efaea85-081f-4886-a236-cef18863edf0; Proxy: null)
2022-06-08 11:38:15 UTC+0530 ERROR: Deleting security group named: awseb-e-umh3prditb-stack-MountTargetSecurityGroup-1X6EEF17U2MYO failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: dd6d9505-66b1-4610-9593-630e27a40ab3; Proxy: null)
2022-06-08 11:37:43 UTC+0530 ERROR: Failed to deploy application.
2022-06-08 11:37:43 UTC+0530 ERROR: Creating security group named: awseb-e-umh3prditb-stack-MountTargetSecurityGroup-1X6EEF17U2MYO failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: e1b20536-9371-4c82-999f-8f75b50e65f2; Proxy: null)
2022-06-08 11:37:43 UTC+0530 ERROR: Creating security group named: awseb-e-umh3prditb-stack-loadbalancersg-3H8HOI31196I failed Reason: vpc-id (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterValue; Request ID: 71b7f6ba-416e-4139-a1b4-3e9e26ca9c48; Proxy: null)
2022-06-08 11:37:43 UTC+0530 ERROR: Service:AmazonCloudFormation, Message:Stack named 'awseb-e-umh3prditb-stack' aborted operation. Current state: 'UPDATE_ROLLBACK_IN_PROGRESS' Reason: The following resource(s) failed to create: [MountTargetSecurityGroup, FileSystem, loadbalancersg].
2022-06-08 11:37:18 UTC+0530 INFO: Environment update is starting.

从报错链路判断，部署在CloudFormation创建资源阶段就已经失败回滚，EFS挂载脚本根本未触发执行，和挂载操作本身无关。所有资源创建失败的核心原因是EC2接口返回InvalidParameterValue: vpc-id错误，即传入的VPC参数非法。

• 校验VPC ID参数准确性：检查.ebextensions配置中填写的VPC ID，必须和当前Elastic Beanstalk环境实际部署所在的VPC完全一致，禁止跨账号引用VPC、填写已删除的VPC ID，不要混淆自定义VPC和账号默认VPC的ID。
• 校验子网与VPC的归属关系：配置中填写的EFS挂载目标子网、负载均衡器公网/私网子网，必须全部归属上述VPC，不能跨VPC混用子网。同时确认所选子网处于可用状态，不属于限制资源创建的隔离子网。
• 补全安全组的显式VPC绑定：默认配置模板未显式给安全组指定VPC ID，自定义VPC部署场景下CloudFormation会默认尝试在账号默认VPC下创建安全组，和指定的跨VPC子网不匹配就会触发报错。需要在MountTargetSecurityGroup、loadbalancersg两个安全组的资源定义块中，显式添加VpcId字段，值为EB环境所在VPC的ID。
• 补全EFS资源的VPC关联配置：EFS挂载目标创建时，需显式关联同VPC下的挂载点安全组、对应可用区的子网，不要依赖模板默认值。同时确认EB环境关联的实例服务角色拥有ec2:CreateSecurityGroup、ec2:DescribeVpcs、elasticfilesystem:CreateFileSystem权限，避免权限不足导致参数读取失败，误报VPC参数错误。
• 校验配置文件格式：检查.ebextensions目录下的YAML配置文件是否存在缩进错误、字段拼写错误、参数值多余引号/空格的问题，比如把VpcId拼为vpc-id、vpcID都会导致参数读取为空，触发该类报错。

内容的提问来源于stack exchange，提问作者Srikanth K