Cloudformation中的VPC端点-端点类型(网关)与可用服务类型不匹配([接口])
我正在尝试在 Cloudformation 中为 API 网关创建 VPC 端点,但收到此错误:
Endpoint type (Gateway) does not match available service types ([Interface]).
下面的模板放置在资源部分中:
executeApiEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: "*"
Action:
- "execute-api:Invoke"
- "execute-api:ManageConnections"
Resource:
- "arn:aws:execute-api:*:*:*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
VpcId: !Ref pubPrivateVPC
这个也不起作用:
executeApiEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: "*"
Action:
- "execute-api:*"
Resource:
- "*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
VpcId: !Ref pubPrivateVPC
但是,这个块(来自模板)能够在没有任何错误的情况下执行:
s3Endpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal: "*"
Action:
- "s3:*"
Resource:
- "*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
VpcId: !Ref pubPrivateVPC
这里出了什么问题?
回答
您还必须在资源上指定VpcEndpointType 属性,以便接口类型的 VPC 终端节点正常工作。默认为“网关”,仅适用于 S3 和 DynamoDB VPC 终端节点。AWS::EC2::VPCEndpointInterface
您的解决方案使用 S3 作为端点的原因是因为该VpcEndpointType属性将“网关”作为默认值(适用于 S3)。
THE END
二维码