Question

CFN模板中是否可能根据参数将某些特定的安全组添加到ALB？

我遇到了两个安全组添加到ALB的情况：

ALB Type: AWS::ElasticLoadBalancingV2::LoadBalancer Properties: ... SecurityGroups: - !Ref 'SecurityGroup1' - !Ref 'SecurityGroup2'

现在，仅当某些参数具有特定值时，我才想最终添加一个SecurityGroup3。假设参数add_sg3等于yes，则将第三个SG添加到ALB。在类似情况下，我总是使用"!If，但是有两个以上的SG。任何的建议都受欢迎。谢谢！

Answer 1

您可以使用Condition和AWS::NoValue伪参数来实现。请遵循以下完整示例：

Parameters:
    Environment:
        Type: String
        Default: dev
        AllowedValues: ["dev", "prod"]
    VpcId:
        Type: 'AWS::EC2::VPC::Id'
    Subnet1:
        Type: 'AWS::EC2::Subnet::Id'
    Subnet2:
        Type: 'AWS::EC2::Subnet::Id'

Conditions:
    MyTest: !Equals ["dev", !Ref Environment]

Resources:
    ALB:
        Type: 'AWS::ElasticLoadBalancingV2::LoadBalancer'
        Properties:
            SecurityGroups:
            - !Ref SecurityGroup1
            - !If [ MyTest, !Ref SecurityGroup2, !Ref 'AWS::NoValue' ]
            Subnets:
            - !Ref Subnet1
            - !Ref Subnet2

    SecurityGroup1:
        Type: 'AWS::EC2::SecurityGroup'
        Properties:
            GroupDescription: 'Group 1'
            VpcId: !Ref VpcId

    SecurityGroup2:
        Type: 'AWS::EC2::SecurityGroup'
        Properties:
            GroupDescription: 'Group 2'
            VpcId: !Ref VpcId

AWS CloudFormation-AWS :: ElasticLoadBalancingV2 :: LoadBalancer-SecurityGroups

1 个答案: