Question

我有一个CloudFormation Lambda支持的自定义资源， Lambda在公共子网中起作用，但是当我检查cloudWatch日志时，显示在下面

Log-Message＃1

Starting new HTTPS connection (1): cloudformation-custom-resource-response-eucentral1.s3.eu-central-1.amazonaws.com

Log-Message＃2

Task timed out after 30.03 seconds

如何处理此问题，我的cloudformation如下所示。

 Resources:
 HelloWorld: #Custom Resource
Type: Custom::HelloWorld
Properties:
  ServiceToken:
    Fn::GetAtt:
    - TestFunction #Reference to Function to be run
    - Arn #ARN of the function to be run
  Input1:
    Ref: Message
 TestFunction: #Lambda Function
 Type: AWS::Lambda::Function
 Properties:
  Code:
    S3Bucket:
      Ref: S3Bucket
    S3Key:
      Ref: S3Key
  Handler:
    Fn::Join:
    - ''
    - - Ref: ModuleName
      - ".lambda_handler"
  Role:
    Fn::GetAtt:
    - LambdaExecutionRole
    - Arn
  VpcConfig:
    SecurityGroupIds:
      - !Ref SecurityGroup
    SubnetIds:
      - Fn::Select: [ 0, !Ref PublicSubnet1 ]
      - Fn::Select: [ 0, !Ref PublicSubnet2 ]
  Runtime: python2.7
  Timeout: '30'
   LambdaExecutionRole: #IAM Role for Custom Resource
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
    - Effect: Allow
      Principal:
        Service:
        - lambda.amazonaws.com
      Action:
      - sts:AssumeRole
  Path: "/"
  Policies:
  - PolicyName: root
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
      - Effect: Allow
        Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        Resource: arn:aws:logs:*:*:*
      - Effect: Allow
        Action:
        - ec2:CreateNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DeleteNetworkInterface

        Resource: "*"

   SecurityGroup:
   Type: AWS::EC2::SecurityGroup
   Properties:
    GroupName: "sec_group_name"
    GroupDescription: "SSH traffic in, all traffic out."
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0
    SecurityGroupEgress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0

我的子网路由表与InternetGateway关联，但是它给出了CloudFormationResponse对象错误，如何解决此连接问题。

帮助！谢谢:)）

Answer 1

我猜想您的公共子网没有附加NAT gateway或NAT instance（单独的InternetGateway并不重要）。根据{{3}}，这是必需的。如果您的功能不需要一般的Internet访问但需要访问AWS资源，则应考虑VPC Endpoints。它们比较便宜，但不确定是否可用于所有资源。

CloudFormation响应对象超时

1 个答案: