CloudFormation CFN-Init执行多PowerShell命令失败求助

我来帮你搞定这个CFN-Init执行多个命令失败的问题，仔细看了你的模板，发现几个关键问题，咱们一步步修正：

1. Finalize配置的语法错误 #

你的finalize部分少了commands层级，CFN-Init会因为解析失败跳过这个步骤，甚至可能影响前面命令的执行逻辑。正确的结构应该是：

finalize:
  commands:
    1-signal-success:
      command: powershell.exe -Command "Write-AWSQuickStartStatus"
      waitAfterCompletion: '0'

2. PowerShell命令的引号与变量引用问题 #

第二个创建AD用户的命令存在两个明显问题：

• 变量引用错误：'{$DomainDNSName}'应该是${DomainDNSName}（因为用了!Sub，不需要额外嵌套花括号）
• 密码传递风险：直接在命令行明文传递密码不仅不安全，还容易因为特殊字符导致命令解析失败

修正后的命令用!Sub |来换行提升可读性，同时给密码加上单引号避免特殊字符解析问题：

2-create-user:
  command: !Sub |
    powershell.exe -ExecutionPolicy Bypass -Command "New-ADUser -Name '${DomainAdminUser}' -UserPrincipalName '${DomainAdminUser}@${DomainDNSName}' -AccountPassword (ConvertTo-SecureString '${DomainAdminPassword}' -AsPlainText -Force) -Enabled:$true -PasswordNeverExpires:$true"
  waitAfterCompletion: '1'

3. CFN-Auto-Reloader的Resource参数错误 #

在cfn-auto-reloader.conf里，你写的path=Resources.BastionServer.Metadata.AWS::CloudFormation::Init但action里的--resource LaunchConfig是错的，应该改成你的实例资源名BastionServer，否则钩子无法正确触发：

action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource BastionServer --configsets config --region ${AWS::Region}

4. WaitAfterCompletion的合理设置 #

对于需要确保执行完成的命令（比如安装Windows功能、创建AD用户），应该设置waitAfterCompletion: '1'，让CFN-Init等待命令执行完成后再继续下一个命令。第一个命令的waitAfterCompletion: '0'会导致CFN-Init不等待安装完成就执行后续命令，这很可能是后续命令失败的核心原因之一。

5. 调试建议 #

如果还是有问题，去实例上查看CFN-Init的日志定位具体错误：

• 主日志：C:\cfn\log\cfn-init.log，这里会详细记录每个命令的执行状态和错误信息
• EC2启动日志：C:\ProgramData\Amazon\EC2-Windows\Launch\Log\Ec2Launch.log，可以查看UserData和CFN-Init的启动过程

修正后的完整BastionServer资源片段 #

BastionServer:
  Type: AWS::EC2::Instance
  Metadata:
    AWS::Cloudformation::Init:
      configSets:
        config:
          - setup
          - installADDS
          - finalize
      setup:
        files:
          c:\cfn\cfn-hup.conf:
            content: !Sub |
              [main]
              stack=${AWS::StackId}
              region=${AWS::Region}
          c:\cfn\hooks.d\cfn-auto-reloader.conf:
            content: !Sub |
              [cfn-auto-reloader-hook]
              triggers=post.update
              path=Resources.BastionServer.Metadata.AWS::CloudFormation::Init
              action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource BastionServer --configsets config --region ${AWS::Region}
        services:
          windows:
            cfn-hup:
              enabled: 'true'
              ensureRunning: 'true'
              files:
                - c:\cfn\cfn-hup.conf
                - c:\cfn\hooks.d\cfn-auto-reloader.conf
      installADDS:
        commands:
          1-install-prereqs:
            command: powershell.exe -Command "Install-WindowsFeature RSAT-AD-Powershell RSAT-ADDS-Tools"
            waitAfterCompletion: '1'
          2-create-user:
            command: !Sub |
              powershell.exe -ExecutionPolicy Bypass -Command "New-ADUser -Name '${DomainAdminUser}' -UserPrincipalName '${DomainAdminUser}@${DomainDNSName}' -AccountPassword (ConvertTo-SecureString '${DomainAdminPassword}' -AsPlainText -Force) -Enabled:$true -PasswordNeverExpires:$true"
            waitAfterCompletion: '1'
      finalize:
        commands:
          1-signal-success:
            command: powershell.exe -Command "Write-AWSQuickStartStatus"
            waitAfterCompletion: '0'
  Properties:
    ImageId:
      Fn::FindInMap:
        - "AWSAMIRegionMap"
        - Ref: "AWS::Region"
        - "WS2016FULLBASE"
    InstanceType: t2.medium
    SsmAssociations:
      - DocumentName:
          Ref: "SSMDoc"
    KeyName: !Ref 'KeyPair'
    UserData: !Base64
      Fn::Join:
        - ''
        - - "<script>\n"
          - 'cfn-init.exe -v -c config -s '
          - !Ref 'AWS::StackId'
          - ' -r BastionServer'
          - ' --region '
          - !Ref 'AWS::Region'
          - "\n"
          - "</script>\n"

内容的提问来源于stack exchange，提问作者sp_vennem