amazon-web-services - 部署 CloudFormation 模板导致错误

我想使用来自 GitLab 管道的 AWS CLI 测试 ECS 堆栈的部署。

我的测试项目的核心是 Docker Compose Flask app 的变体。

文件app.py：

import time

from flask import Flask

app = Flask(__name__)

@app.route('/')
def hello():
    return 'Hello World!'

及其 requirements.txt：

flask

Dockerfile 是：

FROM python:3.7-alpine
WORKDIR /code
ENV FLASK_APP=app.py
ENV FLASK_RUN_HOST=0.0.0.0
RUN apk add --no-cache gcc musl-dev linux-headers
COPY requirements.txt requirements.txt
RUN pip install -r requirements.txt
EXPOSE 5000
COPY . .
CMD ["flask", "run"]

Docker Compose 文件是：

version: "3.9"
services:
  web:
    image: registry.gitlab.com/<MYNAME>/<MYPROJECT>
    x-aws-pull_credentials: "<CREDENTIALS>"
    ports:
      - "5000:5000"

我使用 ECS Docker Context（使用 CloudFormationTemplate.yml Docker Context ecs，而不是 myecscontext）和命令生成 default 文件

docker compose convert > CloudFormationTemplate.yml

当我尝试从本地工作站 (Win10) 在 AWS 上进行部署时：

aws cloudformation deploy --template-file CloudFormationTemplate.yml --stack-name test-stack

我收到错误

unacceptable character #x0000: special characters are not allowed
  in "<unicode string>", position 3

怎么了？谢谢。

============

添加

这里是 CloudFormationTemplate.yml：

AWSTemplateFormatVersion: 2010-09-09
Resources:
  CloudMap:
    Properties:
      Description: Service Map for Docker Compose project cloudformation
      Name: cloudformation.local
      Vpc: vpc-XXXXXXXX
    Type: AWS::ServiceDiscovery::PrivateDnsNamespace
  Cluster:
    Properties:
      ClusterName: cloudformation
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
    Type: AWS::ECS::Cluster
  Default5000Ingress:
    Properties:
      CidrIp: 0.0.0.0/0
      Description: web:5000/tcp on default network
      FromPort: 5000
      GroupId:
        Ref: DefaultNetwork
      IpProtocol: TCP
      ToPort: 5000
    Type: AWS::EC2::SecurityGroupIngress
  DefaultNetwork:
    Properties:
      GroupDescription: cloudformation Security Group for default network
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.network
        Value: default
      VpcId: vpc-XXXXXXXX
    Type: AWS::EC2::SecurityGroup
  DefaultNetworkIngress:
    Properties:
      Description: Allow communication within network default
      GroupId:
        Ref: DefaultNetwork
      IpProtocol: "-1"
      SourceSecurityGroupId:
        Ref: DefaultNetwork
    Type: AWS::EC2::SecurityGroupIngress
  LoadBalancer:
    Properties:
      LoadBalancerAttributes:
      - Key: load_balancing.cross_zone.enabled
        Value: "true"
      Scheme: internet-facing
      Subnets:
      - subnet-XXXXXXXX
      - subnet-XXXXXXXX
      - subnet-XXXXXXXX
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      Type: network
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  LogGroup:
    Properties:
      LogGroupName: /docker-compose/cloudformation
    Type: AWS::Logs::LogGroup
  WebService:
    DependsOn:
    - WebTCP5000Listener
    Properties:
      Cluster:
        Fn::GetAtt:
        - Cluster
        - Arn
      DeploymentConfiguration:
        MaximumPercent: 200
        MinimumHealthyPercent: 100
      DeploymentController:
        Type: ECS
      DesiredCount: 1
      LaunchType: FARGATE
      LoadBalancers:
      - ContainerName: web
        ContainerPort: 5000
        TargetGroupArn:
          Ref: WebTCP5000TargetGroup
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
          - Ref: DefaultNetwork
          Subnets:
          - subnet-XXXXXXXX
          - subnet-XXXXXXXX
          - subnet-XXXXXXXX
      PlatformVersion: 1.4.0
      PropagateTags: SERVICE
      SchedulingStrategy: REPLICA
      ServiceRegistries:
      - RegistryArn:
          Fn::GetAtt:
          - WebServiceDiscoveryEntry
          - Arn
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.service
        Value: web
      TaskDefinition:
        Ref: WebTaskDefinition
    Type: AWS::ECS::Service
  WebServiceDiscoveryEntry:
    Properties:
      Description: '"web" service discovery entry in Cloud Map'
      DnsConfig:
        DnsRecords:
        - TTL: 60
          Type: A
        RoutingPolicy: MULTIVALUE
      HealthCheckCustomConfig:
        FailureThreshold: 1
      Name: web
      NamespaceId:
        Ref: CloudMap
    Type: AWS::ServiceDiscovery::Service
  WebTCP5000Listener:
    Properties:
      DefaultActions:
      - ForwardConfig:
          TargetGroups:
          - TargetGroupArn:
              Ref: WebTCP5000TargetGroup
        Type: forward
      LoadBalancerArn:
        Ref: LoadBalancer
      Port: 5000
      Protocol: TCP
    Type: AWS::ElasticLoadBalancingV2::Listener
  WebTCP5000TargetGroup:
    Properties:
      Port: 5000
      Protocol: TCP
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      TargetType: ip
      VpcId: vpc-XXXXXXXX
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
  WebTaskDefinition:
    Properties:
      ContainerDefinitions:
      - Command:
        - XXXXXXXX.compute.internal
        - cloudformation.local
        Essential: false
        Image: docker/ecs-searchdomain-sidecar:1.0
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group:
              Ref: LogGroup
            awslogs-region:
              Ref: AWS::Region
            awslogs-stream-prefix: cloudformation
        Name: Web_ResolvConf_InitContainer
      - DependsOn:
        - Condition: SUCCESS
          ContainerName: Web_ResolvConf_InitContainer
        Essential: true
        Image: registry.gitlab.com/MYUSER/cloudformation
        LinuxParameters: {}
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group:
              Ref: LogGroup
            awslogs-region:
              Ref: AWS::Region
            awslogs-stream-prefix: cloudformation
        Name: web
        PortMappings:
        - ContainerPort: 5000
          HostPort: 5000
          Protocol: tcp
        RepositoryCredentials:
          CredentialsParameter: arn:aws:secretsmanager:XXXXXXXXXXXXXXXXXXXXXXXX
      Cpu: "256"
      ExecutionRoleArn:
        Ref: WebTaskExecutionRole
      Family: cloudformation-web
      Memory: "512"
      NetworkMode: awsvpc
      RequiresCompatibilities:
      - FARGATE
    Type: AWS::ECS::TaskDefinition
  WebTaskExecutionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action:
          - sts:AssumeRole
          Condition: {}
          Effect: Allow
          Principal:
            Service: ecs-tasks.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy
      - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - secretsmanager:GetSecretValue
            - ssm:GetParameters
            - kms:Decrypt
            Condition: {}
            Effect: Allow
            Principal: {}
            Resource:
            - arn:aws:secretsmanager:XXXXXXXXXXXXXXXXXXXXXXXX
        PolicyName: webGrantAccessToSecrets
      Tags:
      - Key: com.docker.compose.project
        Value: cloudformation
      - Key: com.docker.compose.service
        Value: web
    Type: AWS::IAM::Role

docker compose convert 未在默认上下文中创建有效的 CloudFormation (CFN) 模板。在尝试生成它之前，您必须创建 ECS 上下文：

docker context create ecs myecscontext

然后您必须从 default 上下文切换到 myecscontext：

docker context use myecscontext

使用 docker context ls 确认您处于正确的上下文中（即 myecscontext）。然后你可以使用你的 convert 命令

docker compose convert

生成实际的 CFN 模板。

部署 CloudFormation 模板导致错误

1 个答案: