CloudFormation示例：求ELB后端部署EC2的YAML/JSON代码

我来给你一个完整的CloudFormation YAML模板，用来在**Application Load Balancer（ALB，ELB的主流类型）**后端部署EC2实例。这个模板包含了基础的网络架构、负载均衡器、安全组和自动扩容组（保障高可用性），你可以根据自身需求灵活调整参数。

完整模板代码 #

AWSTemplateFormatVersion: '2010-09-09'
Description: 部署Application Load Balancer及后端EC2实例的CloudFormation模板

Parameters:
  InstanceType:
    Type: String
    Default: t2.micro
    Description: EC2实例类型
  AmiId:
    Type: String
    Description: 对应区域的Amazon Linux 2 AMI ID（请替换为你所在区域的有效AMI）
    Default: ami-0c55b159cbfafe1f0 # 示例：us-east-1区域的Amazon Linux 2 AMI
  VpcCidr:
    Type: String
    Default: 10.0.0.0/16
    Description: VPC的CIDR地址块
  Subnet1Cidr:
    Type: String
    Default: 10.0.1.0/24
    Description: 第一个子网的CIDR（需在VPC范围内）
  Subnet2Cidr:
    Type: String
    Default: 10.0.2.0/24
    Description: 第二个子网的CIDR（需在VPC范围内，且与第一个子网分属不同可用区）

Resources:
  # 基础网络资源
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: ELB-EC2-VPC

  Subnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref Subnet1Cidr
      AvailabilityZone: !Select [0, !GetAZs '']
      Tags:
        - Key: Name
          Value: ELB-EC2-Subnet-1

  Subnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref Subnet2Cidr
      AvailabilityZone: !Select [1, !GetAZs '']
      Tags:
        - Key: Name
          Value: ELB-EC2-Subnet-2

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: ELB-EC2-IGW

  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: ELB-EC2-Public-RT

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  Subnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet1
      RouteTableId: !Ref PublicRouteTable

  Subnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Subnet2
      RouteTableId: !Ref PublicRouteTable

  # 安全组
  ELBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 允许外部访问ALB的80端口
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: ELB-SG

  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 允许ALB访问EC2的80端口
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ELBSecurityGroup
      Tags:
        - Key: Name
          Value: EC2-SG

  # Application Load Balancer
  ApplicationLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: ELB-EC2-ALB
      Subnets:
        - !Ref Subnet1
        - !Ref Subnet2
      SecurityGroups:
        - !Ref ELBSecurityGroup
      Scheme: internet-facing
      Tags:
        - Key: Name
          Value: ELB-EC2-ALB

  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: ELB-EC2-TargetGroup
      VpcId: !Ref VPC
      Port: 80
      Protocol: HTTP
      TargetType: instance
      HealthCheckProtocol: HTTP
      HealthCheckPath: /
      HealthCheckIntervalSeconds: 30
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 2

  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref ALBTargetGroup

  # EC2自动扩容组（替代单个实例，提升可用性）
  EC2LaunchConfig:
    Type: AWS::AutoScaling::LaunchConfiguration
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !Ref AmiId
      SecurityGroups:
        - !Ref EC2SecurityGroup
      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "<h1>Hello from EC2 behind ALB!</h1>" > /var/www/html/index.html

  EC2AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier:
        - !Ref Subnet1
        - !Ref Subnet2
      LaunchConfigurationName: !Ref EC2LaunchConfig
      MinSize: 2
      MaxSize: 4
      DesiredCapacity: 2
      TargetGroupARNs:
        - !Ref ALBTargetGroup
      Tags:
        - Key: Name
          Value: ELB-EC2-Instance
          PropagateAtLaunch: true

Outputs:
  ALBDNSName:
    Description: Application Load Balancer的DNS地址
    Value: !GetAtt ApplicationLoadBalancer.DNSName

关键部分说明 #

• Parameters: 你可以在部署模板时自定义实例类型、AMI ID、网络CIDR等参数，无需修改模板核心代码。注意AmiId需要替换为你所在AWS区域的有效AMI（比如Amazon Linux 2或Ubuntu的AMI）。
• 网络资源: 模板创建了带公网访问能力的VPC和两个跨可用区的子网，确保ELB和EC2实例的高可用性。
• 安全组: 严格控制流量：ELB安全组允许所有外部访问80端口，EC2安全组只允许ELB的流量访问80端口，遵循最小权限原则。
• ALB与目标组: ALB负责接收外部请求并转发到目标组中的EC2实例，目标组会自动执行健康检查，剔除异常实例。
• 自动扩容组: 默认部署2台EC2实例（可调整数量），自动关联到目标组，还能根据负载自动扩容/缩容，比单个实例更可靠。

使用注意事项 #

1. 替换AmiId为你所在区域的AMI，你可以通过AWS控制台或aws ec2 describe-images命令获取。
2. 如果不需要自动扩容，也可以把自动扩容组替换为单个AWS::EC2::Instance资源，直接加入目标组。
3. 若需要HTTPS访问，只需给ALB添加SSL证书，修改监听端口为443，并调整安全组规则。

内容的提问来源于stack exchange，提问作者Rudziankoŭ