AWS CloudFormation
User Guide (API Version 2010-05-15)
AWS 服务或AWS文档中描述的功能,可能因地区/位置而异。请点击 Amazon AWS 入门,可查看中国地区的具体差异

Amazon EC2 模板代码段

EC2 块设备映射示例

带块设备映射的 EC2 实例

JSON

"Ec2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "ImageId" : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" }, { "Fn::FindInMap" : [ "AWSInstanceType2Arch", { "Ref" : "InstanceType" }, "Arch" ] } ] }, "KeyName" : { "Ref" : "KeyName" }, "InstanceType" : { "Ref" : "InstanceType" }, "SecurityGroups" : [{ "Ref" : "Ec2SecurityGroup" }], "BlockDeviceMappings" : [ { "DeviceName" : "/dev/sda1", "Ebs" : { "VolumeSize" : "50" } },{ "DeviceName" : "/dev/sdm", "Ebs" : { "VolumeSize" : "100" } } ] } }

YAML

EC2Instance: Type: AWS::EC2::Instance Properties: ImageId: !FindInMap [ AWSRegionArch2AMI, !Ref 'AWS::Region' , !FindInMap [ AWSInstanceType2Arch, !Ref InstanceType, Arch ] ] KeyName: !Ref KeyName InstanceType: !Ref InstanceType SecurityGroups: - !Ref Ec2SecurityGroup BlockDeviceMappings: - DeviceName: /dev/sda1 Ebs: VolumeSize: 50 - DeviceName: /dev/sdm Ebs: VolumeSize: 100

带短暂驱动的 EC2 实例

JSON

"Ec2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "ImageId" : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" }, "PV64" ]}, "KeyName" : { "Ref" : "KeyName" }, "InstanceType" : "m1.small", "SecurityGroups" : [{ "Ref" : "Ec2SecurityGroup" }], "BlockDeviceMappings" : [ { "DeviceName" : "/dev/sdc", "VirtualName" : "ephemeral0" } ] } }

YAML

EC2Instance: Type: AWS::EC2::Instance Properties: ImageId: !FindInMap [ AWSRegionArch2AMI, !Ref 'AWS::Region', PV64 ] KeyName: !Ref KeyName InstanceType: m1.small SecurityGroups: - !Ref Ec2SecurityGroup BlockDeviceMappings: - DeviceName: /dev/sdc VirtualName: ephemeral0

分配一个使用 AWS::EC2::EIP 代码段的 Amazon EC2 弹性 IP

此示例显示了如何分配一个 Amazon EC2 弹性 IP 地址并将其分配给使用 AWS::EC2::EIP 资源 的 Amazon EC2 实例。

JSON

"MyEIP" : { "Type" : "AWS::EC2::EIP", "Properties" : { "InstanceId" : { "Ref" : "logical name of an AWS::EC2::Instance resource" } } }

YAML

MyEIP: Type: AWS::EC2::EIP Properties: InstanceId: !Ref Logical name of an AWS::EC2::Instance resource

将一个现有弹性 IP 指定给使用 AWS::EC2::EIPAssociation 代码段的 Amazon EC2 实例

此示例显示了如何将一个现有 Amazon EC2 弹性 IP 地址分配给使用 AWS::EC2::EIPAssociation 资源 的 Amazon EC2 实例。

JSON

"IPAssoc" : { "Type" : "AWS::EC2::EIPAssociation", "Properties" : { "InstanceId" : { "Ref" : "logical name of an AWS::EC2::Instance resource" }, "EIP" : "existing Elastic IP address" } }

YAML

IPAssoc: Type: AWS::EC2::EIPAssociation Properties: InstanceId: !Ref Logical name of an AWS::EC2::Instance resource EIP: existing Elastic IP Address

将一个现有 VPC 弹性 IP 分配给使用 AWS::EC2::EIPAssociation 代码段的 Amazon EC2 实例

此示例显示了如何将一个现有 VPC 弹性 IP 地址分配给使用 AWS::EC2::EIPAssociation 资源 的 Amazon EC2 实例。

JSON

"VpcIPAssoc" : { "Type" : "AWS::EC2::EIPAssociation", "Properties" : { "InstanceId" : { "Ref" : "logical name of an AWS::EC2::Instance resource" }, "AllocationId" : "existing VPC Elastic IP allocation ID" } }

YAML

VpcIPAssoc: Type: AWS::EC2::EIPAssociation Properties: InstanceId: !Ref Logical name of an AWS::EC2::Instance resource AllocationId: Existing VPC Elastic IP allocation ID

弹性网络接口 (ENI) 模板代码段

VPC_EC2_Instance_With_ENI

显示了如何创建带有两个弹性网络接口 (ENI) 的实例的示例模板。该示例假设您已创建 VPC。

JSON

"Resources" : { "ControlPortAddress" : { "Type" : "AWS::EC2::EIP", "Properties" : { "Domain" : "vpc" } }, "AssociateControlPort" : { "Type" : "AWS::EC2::EIPAssociation", "Properties" : { "AllocationId" : { "Fn::GetAtt" : [ "ControlPortAddress", "AllocationId" ]}, "NetworkInterfaceId" : { "Ref" : "controlXface" } } }, "WebPortAddress" : { "Type" : "AWS::EC2::EIP", "Properties" : { "Domain" : "vpc" } }, "AssociateWebPort" : { "Type" : "AWS::EC2::EIPAssociation", "Properties" : { "AllocationId" : { "Fn::GetAtt" : [ "WebPortAddress", "AllocationId" ]}, "NetworkInterfaceId" : { "Ref" : "webXface" } } }, "SSHSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "VpcId" : { "Ref" : "VpcId" }, "GroupDescription" : "Enable SSH access via port 22", "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : "0.0.0.0/0" } ] } }, "WebSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "VpcId" : { "Ref" : "VpcId" }, "GroupDescription" : "Enable HTTP access via user defined port", "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : 80, "ToPort" : 80, "CidrIp" : "0.0.0.0/0" } ] } }, "controlXface" : { "Type" : "AWS::EC2::NetworkInterface", "Properties" : { "SubnetId" : { "Ref" : "SubnetId" }, "Description" :"Interface for control traffic such as SSH", "GroupSet" : [ {"Ref" : "SSHSecurityGroup"} ], "SourceDestCheck" : "true", "Tags" : [ {"Key" : "Network", "Value" : "Control"}] } }, "webXface" : { "Type" : "AWS::EC2::NetworkInterface", "Properties" : { "SubnetId" : { "Ref" : "SubnetId" }, "Description" :"Interface for web traffic", "GroupSet" : [ {"Ref" : "WebSecurityGroup"} ], "SourceDestCheck" : "true", "Tags" : [ {"Key" : "Network", "Value" : "Web"}] } }, "Ec2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "AMI" ]}, "KeyName" : { "Ref" : "KeyName" }, "NetworkInterfaces" : [ { "NetworkInterfaceId" : {"Ref" : "controlXface"}, "DeviceIndex" : "0" }, { "NetworkInterfaceId" : {"Ref" : "webXface"}, "DeviceIndex" : "1" }], "Tags" : [ {"Key" : "Role", "Value" : "Test Instance"}], "UserData" : {"Fn::Base64" : { "Fn::Join" : ["",[ "#!/bin/bash -ex","\n", "\n","yum install ec2-net-utils -y","\n", "ec2ifup eth1","\n", "service httpd start"]]} } } } }

YAML

Resources: ControlPortAddress: Type: AWS::EC2::EIP Properties: Domain: vpc AssociateControlPort: Type: AWS::EC2::EIPAssociation Properties: AllocationId: !GetAtt ControlPortAddress.AllocationId NetworkInterfaceId: !Ref controlXface WebPortAddress: Type: AWS::EC2::EIP Properties: Domain: vpc AssociateWebPort: Type: AWS::EC2::EIPAssociation Properties: AllocationId: !GetAtt WebPortAddress.AllocationId NetworkInterfaceId: !Ref webXface SSHSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: VpcId: !Ref VpcId GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - CidrIp: 0.0.0.0/0 FromPort: 22 IpProtocol: tcp ToPort: 22 WebSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: VpcId: !Ref VpcId GroupDescription: Enable HTTP access via user defined port SecurityGroupIngress: - CidrIp: 0.0.0.0/0 FromPort: 80 IpProtocol: tcp ToPort: 80 controlXface: Type: AWS::EC2::NetworkInterface Properties: SubnetId: !Ref SubnetId Description: Interface for controlling traffic such as SSH GroupSet: - !Ref SSHSecurityGroup SourceDestCheck: true Tags: - Key: Network Value: Control webXface: Type: AWS::EC2::NetworkInterface Properties: SubnetId: !Ref SubnetId Description: Interface for controlling traffic such as SSH GroupSet: - !Ref WebSecurityGroup SourceDestCheck: true Tags: - Key: Network Value: Web Ec2Instance: Type: AWS::EC2::Instance Properties: ImageId: !FindInMap [ RegionMap, !Ref 'AWS::Region', AMI ] KeyName: !Ref KeyName NetworkInterfaces: - NetworkInterfaceId: !Ref controlXface DeviceIndex: 0 - NetworkInterfaceId: !Ref webXface DeviceIndex: 1 Tags: - Key: Role Value: Test Instance UserData: Fn::Base64: !Sub | #!/bin/bash -xe yum install ec2-net-utils -y ec2ifup eth1 service httpd start

Amazon EC2 实例资源

此代码段所示为简单的 AWS::EC2::Instance 资源。

JSON

"MyInstance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "AvailabilityZone" : "us-east-1a", "ImageId" : "ami-20b65349" } }

YAML

MyInstance: Type: AWS::EC2::Instance Properties: AvailabilityZone: us-east-1a ImageId: ami-20b65349

带 Volume、Tag 和 UserData 属性的 Amazon EC2 实例

此代码段显示了带一个 Amazon EC2 卷、一个标签和一个用户数据属性的 AWS::EC2::Instance 资源。必须在同一个模板中定义 AWS::EC2::SecurityGroup 资源、AWS::SNS::Topic 资源和 AWS::EC2::Volume 资源。此外,对 KeyName 的引用是必须在模板的 Parameters 部分中定义的参数。

JSON

"MyInstance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "KeyName" : { "Ref" : "KeyName" }, "SecurityGroups" : [ { "Ref" : "logical name of AWS::EC2::SecurityGroup resource" } ], "UserData" : { "Fn::Base64" : { "Fn::Join" : [ ":", [ "PORT=80", "TOPIC=", { "Ref" : "logical name of an AWS::SNS::Topic resource" } ] ] } }, "InstanceType" : "m1.small", "AvailabilityZone" : "us-east-1a", "ImageId" : "ami-1e817677", "Volumes" : [ { "VolumeId" : { "Ref" : "logical name of AWS::EC2::Volume resource" }, "Device" : "/dev/sdk" } ], "Tags" : [ { "Key" : "Name", "Value" : "MyTag" } ] } }

YAML

MyInstance: Type: AWS::EC2::Instance Properties: KeyName: !Ref KeyName SecurityGroups: - !Ref logical name of AWS::EC2::SecurityGroup resource UserData: Fn::Base64: !Sub | PORT=80 TOPIC=${ logical name of an AWS::SNS::Topic resource } InstanceType: m1.small AvailabilityZone: us-east-1a ImageId: ami-1e817677 Volumes: - VolumeId: !Ref logical name of AWS::EC2::Volume resource Device: /dev/sdk Tags: - Key: Name Value: MyTag

带 Amazon SimpleDB 域的 Amazon EC2 实例资源

此代码段显示的是带 UserData 中所指定 Amazon SimpleDB 域的 AWS::EC2::Instance 资源。

JSON

"MyInstance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "UserData" : { "Fn::Base64" : { "Fn::Join" : [ "", [ "Domain=", { "Ref" : "logical name of an AWS::SDB::Domain resource" } ] ] } }, "AvailabilityZone" : "us-east-1a", "ImageId" : "ami-20b65349" } }

YAML

MyInstance: Type: AWS::EC2::Instance Properties: UserData: Fn::Base64: !Sub | Domain=${ logical name of an AWS::SDB::Domain resource } AvailabilityZone: us-east-1a ImageId: ami-20b65349

带两个 CIDR 范围入口规则的 Amazon EC2 安全组资源

此代码段显示的是 AWS::EC2::SecurityGroup 资源,该资源用于描述两个授予对特定端口上 TCP 协议之特定 CIDR 范围访问权的两个入口规则。

JSON

"ServerSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "GroupDescription" : "allow connections from specified CIDR ranges", "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "CidrIp" : "0.0.0.0/0" },{ "IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : "192.168.1.1/32" } ] } }

YAML

ServerSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: allow connections from specified CIDR ranges SecurityGroupIngress: - IpProtocol: tcp FromPort: 80 ToPort: 80 CidrIp: 0.0.0.0/0 - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 192.168.1.1/32

带两个安全组入口规则的 Amazon EC2 安全组资源

此代码段显示的是描述两个安全组入口规则的 AWS::EC2::SecurityGroup 资源。第一个入口规则授权对端口 22 上的 TCP 协议之现有安全组 myadminsecuritygroup 的访问权限,该规则归 1234-5678-9012 AWS 账户所有。第二个入口规则授予对端口 80 上的 TCP 之安全组 mysecuritygroupcreatedincfn 的访问权限。此入口规则使用参考内部函数参考同一个模板中创建的安全组(其逻辑名称为 mysecuritygroupcreatedincfn)。您必须声明 SourceSecurityGroupNameSourceSecurityGroupOwnerId 属性的值。

JSON

"ServerSecurityGroupBySG" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "GroupDescription" : "allow connections from specified source security group", "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "SourceSecurityGroupName" : "myadminsecuritygroup", "SourceSecurityGroupOwnerId" : "123456789012" }, { "IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "SourceSecurityGroupName" : {"Ref" : "mysecuritygroupcreatedincfn"} } ] } }

YAML

ServerSecurityGroupBySG: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: allow connections from specified source security group SecurityGroupIngress: - IpProtocol: tcp FromPort: 80 ToPort: 80 SourceSecurityGroupName: myadminsecuritygroup SourceSecurityGroupOwnerId: 123456789012 - IpProtocol: tcp FromPort: 80 ToPort: 80 SourceSecurityGroupName: !Ref mysecuritygroupcreatedincfn

带 LoadBalancer 入口规则的 Amazon EC2 安全组资源

此模板显示的是包含安全组入口规则的 AWS::EC2::SecurityGroup 资源,该入口规则向 LoadBalancer myELB 授予对端口 80 上的 TCP 的访问权。请注意规则使用 myELB 资源的 SourceSecurityGroup.OwnerAliasSourceSecurityGroup.GroupName 属性指定 LoadBalancer 的源安全组。

JSON

{ "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "myELB": { "Type": "AWS::ElasticLoadBalancing::LoadBalancer", "Properties": { "AvailabilityZones": [ "eu-west-1a" ], "Listeners": [ { "LoadBalancerPort": "80", "InstancePort": "80", "Protocol": "HTTP" } ] } }, "myELBIngressGroup": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "ELB ingress group", "SecurityGroupIngress": [ { "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "SourceSecurityGroupOwnerId": { "Fn::GetAtt": [ "myELB", "SourceSecurityGroup", "OwnerAlias" ] }, "SourceSecurityGroupName": { "Fn::GetAtt": [ "myELB", "SourceSecurityGroup", "GroupName" ] } } ] } } } }

YAML

AWSTemplateFormatVersion: 2010-09-09 Resources: myELB: Type: 'AWS::ElasticLoadBalancing::LoadBalancer' Properties: AvailabilityZones: - eu-west-1a Listeners: - LoadBalancerPort: '80' InstancePort: '80' Protocol: HTTP myELBIngressGroup: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: ELB ingress group SecurityGroupIngress: - IpProtocol: tcp FromPort: '80' ToPort: '80' SourceSecurityGroupOwnerId: !GetAtt myELB.SourceSecurityGroup.OwnerAlias SourceSecurityGroupName: !GetAtt myELB.SourceSecurityGroup.GroupName

使用 AWS::EC2::SecurityGroupIngress 来创建互相参考的 Amazon EC2 安全组资源

此代码段显示的是两个将相互入口规则添加到 EC2 安全组 SGroup1 和 SGroup2 的 AWS::EC2::SecurityGroupIngress 资源。SGroup1Ingress 资源可使 SGroup2 的入口通过 TCP/IP 端口 80 连至 SGroup1。SGroup2Ingress 资源可使 SGroup1 的入口通过 TCP/IP 端口 80 连至 SGroup2。

注意

如果您使用的是 Amazon VPC,请使用 AWS::EC2::SecurityGroup 资源并指定 VpcId 属性。

JSON

"SGroup1" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "GroupDescription" : "EC2 Instance access" } }, "SGroup2" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "GroupDescription" : "EC2 Instance access" } }, "SGroup1Ingress" : { "Type" : "AWS::EC2::SecurityGroupIngress", "Properties" : { "GroupName" : { "Ref" : "SGroup1" }, "IpProtocol" : "tcp", "ToPort" : "80", "FromPort" : "80", "SourceSecurityGroupName" : { "Ref" : "SGroup2" } } }, "SGroup2Ingress" : { "Type" : "AWS::EC2::SecurityGroupIngress", "Properties" : { "GroupName" : { "Ref" : "SGroup2" }, "IpProtocol" : "tcp", "ToPort" : "80", "FromPort" : "80", "SourceSecurityGroupName" : { "Ref" : "SGroup1" } } }

YAML

SGroup1: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: EC2 Instance access SGroup2: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: EC2 Instance access SGroup1Ingress: Type: AWS::EC2::SecurityGroupIngress Properties: GroupName: !Ref SGroup1 IpProtocol: tcp ToPort: 80 FromPort: 80 SourceSecurityGroupName: !Ref SGroup2 SGroup2Ingress: Type: AWS::EC2::SecurityGroupIngress Properties: GroupName: !Ref SGroup2 IpProtocol: tcp ToPort: 80 FromPort: 80 SourceSecurityGroupName: !Ref SGroup1

Amazon EC2 卷资源

此代码段显示的是 DeletionPolicy 属性设置为 Snapshot 的简单 Amazon EC2 卷资源。在 Snapshot DeletionPolicy 已设置的情况下,AWS CloudFormation 会在堆栈删除期间在删除卷之前获取该卷的快照。确保您指定了 SnapShotId 的值或 Size 的值,而不是指定了这两个值。删除您不需要的值。

JSON

"MyEBSVolume" : { "Type" : "AWS::EC2::Volume", "Properties" : { "Size" : "specify a size if no SnapShotId", "SnapshotId" : "specify a SnapShotId if no Size", "AvailabilityZone" : { "Ref" : "AvailabilityZone" } }, "DeletionPolicy" : "Snapshot" }

YAML

MyEBSVolume: Type: AWS::EC2::Volume Properties: Size: specify a size if no SnapshotId SnapshotId: specify a SnapShotId if no Size AvailabilityZone: !Ref AvailabilityZone DeletionPolicy: Snapshot

Amazon EC2 VolumeAttachment 资源

此代码段显示的是以下资源:美国东部(弗吉尼亚北部)区域使用 Amazon Linux AMI 的 Amazon EC2 实例、允许 SSH 访问 IP 地址的 EC2 安全组、容量为 100 GB 且与 EC2 实例在同一个可用区的新 Amazon EBS 卷和将新卷附加到 EC2 实例的卷附件。

JSON

"Resources" : { "Ec2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ], "ImageId" : "ami-76f0061f" } }, "InstanceSecurityGroup" : { "Type" : "AWS::EC2::SecurityGroup", "Properties" : { "GroupDescription" : "Enable SSH access via port 22", "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : "0.0.0.0/0" } ] } }, "NewVolume" : { "Type" : "AWS::EC2::Volume", "Properties" : { "Size" : "100", "AvailabilityZone" : { "Fn::GetAtt" : [ "Ec2Instance", "AvailabilityZone" ]}, } }, "MountPoint" : { "Type" : "AWS::EC2::VolumeAttachment", "Properties" : { "InstanceId" : { "Ref" : "Ec2Instance" }, "VolumeId" : { "Ref" : "NewVolume" }, "Device" : "/dev/sdh" } } }

YAML

Resources: Ec2Instance: Type: AWS::EC2::Instance Properties: SecurityGroups: - !Ref InstanceSecurityGroup ImageId: ami-76f0061f InstanceSecurityGroup: Type: AWS::EC2::SecurityGroup Properties: GroupDescription: Enable SSH access via port 22 SecurityGroupIngress: - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: 0.0.0.0/0 NewVolume: Type: AWS::EC2::Volume Properties: Size: 100 AvailabilityZone: !GetAtt Ec2Instance.AvailabilityZone MountPoint: Type: AWS::EC2::VolumeAttachment Properties: InstanceId: !Ref Ec2Instance VolumeId: !Ref NewVolume Device: /dev/sdh

默认 VPC 安全组中的 Amazon EC2 实例

当您创建了一个 VPC 时,AWS 将为该 VPC 自动创建默认资源,如安全组。但是,当您在 AWS CloudFormation 模板中定义 VPC 时,您还没有这些默认资源的物理 ID。要获取 ID,请使用 Fn::GetAtt 内部函数。这样,您就可以使用默认资源而不用在您的模板中创建新资源。例如,以下模板代码段将 myVPC VPC 的默认安全组与 myInstance Amazon EC2 实例关联。

JSON

"myVPC": { "Type": "AWS::EC2::VPC", "Properties": { "CidrBlock": {"Ref": "myVPCCIDRRange"}, "EnableDnsSupport": false, "EnableDnsHostnames": false, "InstanceTenancy": "default" } }, "myInstance" : { "Type" : "AWS::EC2::Instance", "Properties" : { "ImageId": { "Fn::FindInMap": ["AWSRegionToAMI",{"Ref": "AWS::Region"},"64"] }, "SecurityGroupIds" : [{"Fn::GetAtt": ["myVPC", "DefaultSecurityGroup"]}], "SubnetId" : {"Ref" : "mySubnet"} } }

YAML

myVPC: Type: AWS::EC2::VPC Properties: CidrBlock: !Ref myVPCCIDRRange EnableDnsSupport: false EnableDnsHostnames: false InstanceTenancy: default myInstance: Type: AWS::EC2::Instance Properties: ImageId: !FindInMap [ AWSRegionToAMI , !Ref 'AWS::Region', 64 ] SecurityGroupIds: - !GetAtt myVPC.DefaultSecurityGroup SubnetId: !Ref mySubnet

带仅出口 Internet 网关的 Amazon EC2 路由

以下模板设置用于 EC2 路由的仅出口 Internet 网关。

JSON

{ "Resources": { "DefaultIpv6Route": { "Properties": { "DestinationIpv6CidrBlock": "::/0", "EgressOnlyInternetGatewayId": { "Ref": "EgressOnlyInternetGateway" }, "RouteTableId": { "Ref": "RouteTable" } }, "Type": "AWS::EC2::Route" }, "EgressOnlyInternetGateway": { "Properties": { "VpcId": { "Ref": "VPC" } }, "Type": "AWS::EC2::EgressOnlyInternetGateway" }, "RouteTable": { "Properties": { "VpcId": { "Ref": "VPC" } }, "Type": "AWS::EC2::RouteTable" }, "VPC": { "Properties": { "CidrBlock": "10.0.0.0/16" }, "Type": "AWS::EC2::VPC" } } }

YAML

Resources: DefaultIpv6Route: Type: AWS::EC2::Route Properties: DestinationIpv6CidrBlock: "::/0" EgressOnlyInternetGatewayId: !Ref EgressOnlyInternetGateway RouteTableId: !Ref RouteTable EgressOnlyInternetGateway: Type: AWS::EC2::EgressOnlyInternetGateway Properties: VpcId: !Ref VPC RouteTable: Type: AWS::EC2::RouteTable Properties: VpcId: !Ref VPC VPC: Type: AWS::EC2::VPC Properties: CidrBlock: 10.0.0.0/16