4

我有一个 CloudFormation Lambda 支持的自定义资源，公共子网中的 Lambda 函数，但是当我检查下面显示的 cloudWatch 日志时

日志消息#1

Starting new HTTPS connection (1): cloudformation-custom-resource-response-eucentral1.s3.eu-central-1.amazonaws.com

日志消息#2

Task timed out after 30.03 seconds

我该如何处理这个问题，我的 cloudformation 如下所示。

 Resources:
 HelloWorld: #Custom Resource
Type: Custom::HelloWorld
Properties:
  ServiceToken:
    Fn::GetAtt:
    - TestFunction #Reference to Function to be run
    - Arn #ARN of the function to be run
  Input1:
    Ref: Message
 TestFunction: #Lambda Function
 Type: AWS::Lambda::Function
 Properties:
  Code:
    S3Bucket:
      Ref: S3Bucket
    S3Key:
      Ref: S3Key
  Handler:
    Fn::Join:
    - ''
    - - Ref: ModuleName
      - ".lambda_handler"
  Role:
    Fn::GetAtt:
    - LambdaExecutionRole
    - Arn
  VpcConfig:
    SecurityGroupIds:
      - !Ref SecurityGroup
    SubnetIds:
      - Fn::Select: [ 0, !Ref PublicSubnet1 ]
      - Fn::Select: [ 0, !Ref PublicSubnet2 ]
  Runtime: python2.7
  Timeout: '30'
   LambdaExecutionRole: #IAM Role for Custom Resource
Type: AWS::IAM::Role
Properties:
  AssumeRolePolicyDocument:
    Version: '2012-10-17'
    Statement:
    - Effect: Allow
      Principal:
        Service:
        - lambda.amazonaws.com
      Action:
      - sts:AssumeRole
  Path: "/"
  Policies:
  - PolicyName: root
    PolicyDocument:
      Version: '2012-10-17'
      Statement:
      - Effect: Allow
        Action:
        - logs:CreateLogGroup
        - logs:CreateLogStream
        - logs:PutLogEvents
        Resource: arn:aws:logs:*:*:*
      - Effect: Allow
        Action:
        - ec2:CreateNetworkInterface
        - ec2:DescribeNetworkInterfaces
        - ec2:DeleteNetworkInterface

        Resource: "*"

   SecurityGroup:
   Type: AWS::EC2::SecurityGroup
   Properties:
    GroupName: "sec_group_name"
    GroupDescription: "SSH traffic in, all traffic out."
    VpcId: !Ref VPC
    SecurityGroupIngress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0
    SecurityGroupEgress:
      - IpProtocol: -1
        CidrIp: 0.0.0.0/0

我的子网路由表与 InternetGateway 关联，但它给出 CloudFormationResponse 对象错误，我该如何解决这个连接问题。

帮助 ！谢谢 ：））

4

1 回答 1

1

我猜你的公共子网没有NAT gateway或NAT instance附加到它（InternetGateway单独是不够的）。根据AWS，这是必需的。如果您的函数不需要一般的 Internet 访问，但需要访问 AWS 资源，您应该考虑VPC Endpoints. 它们更便宜，但不确定是否适用于所有资源。

于 2019-03-13T13:54:31.500 回答