How to use existing VPC in AWS CloudFormation template for new SecurityGroup

user_1381266 0
Viewed 2871

I am trying to EC2 instance (new), Security group (new) and VPC(existing). Here is my cloudformation template.

When I run the template in Stack, I got error as *"Value () for parameter groupId is invalid. The value cannot be empty"*. How to solve this?

Template:

Parameters:
  VPCID:
    Description: Name of an existing VPC
    Type: AWS::EC2::VPC::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - t2.large
  AccessLocation:
    Description: The IP address range that can be used to access to the EC2 instances
    Type: String
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref 'InstanceType'
      SecurityGroups:
        - !Ref 'InstanceSecurityGroup'
      KeyName: !Ref 'KeyName'
      ImageId: !Ref 'ImageId'   
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCID
      GroupDescription: Enable SSH 
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref 'AccessLocation'
amazon-vpc amazon-cloudformation amazon-web-services yaml
2 Answers

SecurityGroups can only be used for default VPC. Since you are explicitly assigning VPCID to InstanceSecurityGroup, this will be considered as non-default, resulting in failed deployment.

You must use SecurityGroupIds (not SecurityGroups) in your case as your VPC use will be considered as non-default:

      SecurityGroupIds:
        - !GetAtt 'InstanceSecurityGroup.GroupId'
user_2488230

The error in EC2Instance resource in SecurityGroups attribute. SecurityGroups needs an array of GroupId but when you use !Ref InstanceSecurityGroup this returns ResourceId. So you need to use GetAtt instead to get GroupId.

Parameters:
  VPCID:
    Description: Name of an existing VPC
    Type: AWS::EC2::VPC::Id
  KeyName:
    Description: Name of an existing EC2 KeyPair to enable SSH access to the instance
    Type: AWS::EC2::KeyPair::KeyName
    ConstraintDescription: must be the name of an existing EC2 KeyPair.
  InstanceType:
    Description: EC2 instance type
    Type: String
    Default: t2.medium
    AllowedValues:
      - t2.medium
      - t2.large
  AccessLocation:
    Description: The IP address range that can be used to access to the EC2 instances
    Type: String
Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref 'InstanceType'
      SecurityGroups:
        - !GetAtt InstanceSecurityGroup.GroupId
      KeyName: !Ref 'KeyName'
      ImageId: !Ref 'ImageId'   
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPCID
      GroupDescription: Enable SSH 
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          CidrIp: !Ref 'AccessLocation'

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html

user_111486590
Related