【发布时间】：2019-07-04 12:56:22
【问题描述】：
我在运行 cognito 快速入门堆栈时遇到以下错误：
Embedded stack arn:aws:cloudformation:eu-west-1:950742359761:stack/SaaS-identity-with-Cognito-IdentityStack-17TE8ATW0MEDM/35414bc0-2dab-11e9-801f-02f49d781af6 was not successfully created: The following resource(s) failed to create: [SecurityGroups, Role, DynamoDBTables, BucketRepository].
我不知道为什么会这样。
Values entered for the template are the following:
S3 URL: https://aws-quickstart.s3.amazonaws.com/saas-identity-cognito/templates/saas-identity-cognito-master.template This is supplied by Amazon
Available Zones: eu-central-1a and eu-central-1b
Key Pair Name: Dev-Cognito-KP (I created this and selected it from the drop down)
IAM role name: SaaS-Cognito-Stack (System and Network Administrator Policies)
Capabilities: Check both boxes.
其他一切都是模板中的默认值。
这是仪表板上报告的故障。它说 VPCStack 在尝试创建 NAT 和路由表时失败。 VPCStack 的其他部分完全没有任何问题。
这是模板：
---
AWSTemplateFormatVersion: 2010-09-09
Description: This CloudFormation ... (Removed to shorten post)
Metadata:
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: Network Configuration
Parameters:
- AvailabilityZones
- VPCCIDR
- PrivateSubnet1CIDR
- PrivateSubnet2CIDR
- PublicSubnet1CIDR
- PublicSubnet2CIDR
- Label:
default: AWS Quick Start Configuration
Parameters:
- QSS3BucketName
- QSS3KeyPrefix
- Label:
default: SaaS Identity Quick Start Configuration
Parameters:
- KeyPairName
- InstanceType
- Label:
default: SaaS Identity Sys Admin Configuration
Parameters:
- Email
- Company
- Firstname
- Lastname
- Label:
default: SaaS Identity DynamoDB Table Configuration
Parameters:
- UserTable
- TenantTable
- ProductTable
- OrderTable
ParameterLabels:
AvailabilityZones:
default: Availability Zones
KeyPairName:
default: Key Pair Name
InstanceType:
default: Instance Type
PrivateSubnet1CIDR:
default: Private Subnet 1 CIDR
PrivateSubnet2CIDR:
default: Private Subnet 2 CIDR
PublicSubnet1CIDR:
default: Public Subnet 1 CIDR
PublicSubnet2CIDR:
default: Public Subnet 2 CIDR
QSS3KeyPrefix:
default: Quick Start S3 Key Prefix
QSS3BucketName:
default: Quick Start S3 Bucket Name
VPCCIDR:
default: VPC CIDR
Email:
default: Email Address
Company:
default: Company Name
Firstname:
default: First Name
Lastname:
default: Last Name
UserTable:
default: User
TenantTable:
default: Tenant
ProductTable:
default: Product
OrderTable:
default: Order
Parameters:
AvailabilityZones:
Description: 'List of Availability Zones to use for the subnets in the VPC. Note:
The logical order is preserved and only 2 AZs are used for this deployment.'
Type: List<AWS::EC2::AvailabilityZone::Name>
KeyPairName:
Description: Public/private ... (Removed to shorten post)
Type: AWS::EC2::KeyPair::KeyName
InstanceType:
Type: String
Default: t2.small
AllowedValues:
- t2.micro
- t2.small
- t2.large
Description: Enter t2.micro, t2.small, or t2.large. Default is t2.small.
PrivateSubnet1CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.0.0/19
Description: CIDR block for private subnet 1 located in Availability Zone 1.
Type: String
PrivateSubnet2CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.32.0/19
Description: CIDR block for private subnet 2 located in Availability Zone 2.
Type: String
PublicSubnet1CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.128.0/20
Description: CIDR Block for the public DMZ subnet 1 located in Availability Zone
1
Type: String
PublicSubnet2CIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.144.0/20
Description: CIDR Block ... (Shortened)
2
Type: String
QSS3BucketName:
AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$
ConstraintDescription: Quick Start bucket name can include numbers, lowercase
letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen
(-).
Default: aws-quickstart
Description: S3 bucket name for the Quick Start assets. Quick Start bucket name
can include numbers, lowercase letters, uppercase letters, and hyphens (-).
It cannot start or end with a hyphen (-).
Type: String
QSS3KeyPrefix:
AllowedPattern: ^[0-9a-zA-Z-/]*$
ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters,
uppercase letters, hyphens (-), and a forward slash (/) at the end of the prefix.
Default: saas-identity-cognito/
Description: S3 key prefix ... (Shortened)
Type: String
VPCCIDR:
AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$
ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16-28
Default: 10.0.0.0/16
Description: CIDR Block for the VPC
Type: String
Email:
Description: The Email Address of the Sys Admin.
Default: email@example.com
Type: String
Company:
Description: The Name of the Company that will manage the Reference Architecture.
Default: MyCompanyName
Type: String
Firstname:
Description: The First Name of the Sys Admin.
Default: MyFirstName
Type: String
Lastname:
Description: The Last Name of the Sys Admin.
Default: MyLastName
Type: String
UserTable:
Description: The DynamoDB Table for Users of the Multi-Tenant System
Default: User
Type: String
TenantTable:
Description: The DynamoDB Table for Tenants of the Multi-Tenant System
Default: Tenant
Type: String
ProductTable:
Description: The DynamoDB Table for Products of the Multi-Tenant System
Default: Product
Type: String
OrderTable:
Description: The DynamoDB Table for Orders of the Multi-Tenant System
Default: Order
Type: String
Resources:
VPCStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: !Sub https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template
Parameters:
AvailabilityZones:
!Join
- ','
- !Ref AvailabilityZones
KeyPairName: !Ref KeyPairName
NumberOfAZs: '2'
PrivateSubnet1ACIDR: !Ref PrivateSubnet1CIDR
PrivateSubnet2ACIDR: !Ref PrivateSubnet2CIDR
PublicSubnet1CIDR: !Ref PublicSubnet1CIDR
PublicSubnet2CIDR: !Ref PublicSubnet2CIDR
VPCCIDR: !Ref VPCCIDR
IdentityStack:
DependsOn: VPCStack
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: !Sub https://${QSS3BucketName}.s3.amazonaws.com/${QSS3KeyPrefix}templates/saas-identity-cognito.template
Parameters:
KeyPairName: !Ref KeyPairName
InstanceType: !Ref InstanceType
PublicSubnet1ID:
!GetAtt
- VPCStack
- Outputs.PublicSubnet1ID
PublicSubnet2ID:
!GetAtt
- VPCStack
- Outputs.PublicSubnet2ID
PrivateSubnet1ID:
!GetAtt
- VPCStack
- Outputs.PrivateSubnet1AID
PrivateSubnet2ID:
!GetAtt
- VPCStack
- Outputs.PrivateSubnet2AID
QSS3BucketName: !Ref QSS3BucketName
QSS3KeyPrefix: !Ref QSS3KeyPrefix
Email: !Ref Email
Company: !Ref Company
Firstname: !Ref Firstname
Lastname: !Ref Lastname
UserTable: !Ref UserTable
TenantTable: !Ref TenantTable
ProductTable: !Ref ProductTable
OrderTable: !Ref OrderTable
VPCID:
!GetAtt
- VPCStack
- Outputs.VPCID
Outputs:
Website:
Description: The URL endpoint for the product service
Value: !GetAtt IdentityStack.Outputs.Website
...
【问题讨论】：
-
第一个创建失败的资源是什么？检查模板中的模板 URL。
-
我添加了有问题的堆栈、VPCStack 和模板。我是 CloudFormation 和 Cognito 的新手，因此如果您需要更多信息，我将需要有关如何检索它的说明。 - 感谢 ASR 的帮助！
-
可能是角色问题（您提供的角色）。这似乎对我有用，我没有提供任何角色（因此 CFN 担任了我的管理员角色）。
-
我以
AdministratorAccess角色运行。 -
与 AWS Support 合作提高所需资源的默认账户限制。这不是想象中的权限问题。每个 aws 帐户都有限制，必须通过支持票来增加。示例：最多 5 个弹性 IP，这就是失败的原因。我有 4 个，有了这个，它把我的帐户推到了 6 个。
标签： amazon-web-services amazon-cloudformation amazon-cognito