Security group sg-0da667222da8a6eb2 does not appear to belong to the same VPC as the input subnets

user_4509247 0
Viewed 432

As part of the CI/CD Jenkins pipeline, I am deploying a springboot application to AWS EC2/Fargate using cloudformation from an image available at dockerhub. I have my access key, the secret, region, and subnet defined as secrets that are passed at runtime. The cloudformation deployment is failing with status CREATE_FAILED and the following error:

Invalid request provided: CreateService error: Security group
sg-0da667222da8a6eb2 does not appear to belong to the same VPC as the
input subnets. (Service: Ecs, Status Code: 400, Request ID:
503ce486-c3db-4d35-bb92-5f4770662c05, Extended Request ID: null)

Here is my cloudformation yaml file content:

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  SubnetID:
    Type: String
  ServiceName:
    Type: String
  ServiceVersion:
    Type: String
  DockerHubUsername:
    Type: String
Resources:
  Cluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: deployment-example-cluster
  ServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: ServiceSecurityGroup
      GroupDescription: Security group for service
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0
  TaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: !Sub ${ServiceName}-task
      Cpu: 256
      Memory: 512
      NetworkMode: awsvpc
      ContainerDefinitions:
        - Name: !Sub ${ServiceName}-container
          Image: !Sub ${DockerHubUsername}/${ServiceName}:${ServiceVersion}
          PortMappings:
            - ContainerPort: 8080
      RequiresCompatibilities:
        - EC2
        - FARGATE
  Service:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Sub ${ServiceName}-service
      Cluster: !Ref Cluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 1
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref SubnetID
          SecurityGroups:
            - !GetAtt ServiceSecurityGroup.GroupId

Here is screenshot of cloudformation stack building process:

enter image description here

Surprisingly, sg-0da667222da8a6eb2 is not one of my security groups. Any help will be appreciated.

amazon-cloudformation spring-boot amazon-web-services amazon-ec2
2 Answers

Your ServiceSecurityGroup, as it is defined, it is created in a default VPC. However, your SubnetID probably belongs to a custom VPC. Therefore, you have to provide VpcId for your ServiceSecurityGroup:

Parameters:

  VpcId:
    Type: AWS::EC2::VPC::Id

  # others not shown

Resources:

  # only relevant part shown

  ServiceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: ServiceSecurityGroup
      GroupDescription: Security group for service
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 0.0.0.0/0
      VpcId: !Ref VpcId   

  Service:
    Type: AWS::ECS::Service
    Properties:
      ServiceName: !Sub ${ServiceName}-service
      Cluster: !Ref Cluster
      TaskDefinition: !Ref TaskDefinition
      DesiredCount: 1
      LaunchType: FARGATE
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          Subnets:
            - !Ref SubnetID
          SecurityGroups:
            - !GetAtt ServiceSecurityGroup.GroupId
user_2488230

I am using a custom VPC and not the default VPC in my setup. When cloudformation kicks in, it looks to build the resources in the default VPC in the absence of the information provided. In my case when I pass the custom VPC from my Jenkins as an environment variable, the stack comes up as expected.

user_45092470
Related