Cloudformation - Rds fails when stack is build

1
votes

I am creating a cloudformation template that will create a vpc with 2 subnets one for ec2 instance and other for rds (mysql). My yml file is working fine till ec2 instance but when I add the details of rds to yml file it fails when building the stack.

---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 11.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2a
      VpcId: !Ref VPC
      CidrBlock: 11.0.1.0/24
      MapPublicIpOnLaunch: true
  SubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2a
      VpcId: !Ref VPC
      CidrBlock: 11.0.0.0/24
      MapPublicIpOnLaunch: false
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  InternetRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      RouteTableId: !Ref RouteTable
  SubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetA
  SubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetB
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "Internet Group"
      GroupDescription: "SSH traffic in, all traffic out."
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: "22"
          ToPort: "22"
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
  webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      KeyName: (webserver)
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
  MyDB:
    Type: AWS::RDS::DBInstance
    Properties:
      DBSecurityGroups:
        - Ref: webserver
      AllocatedStorage: "5"
      DBInstanceClass: db.m1.small
      Engine: MySQL
      EngineVersion: "5.7.22"
      DBName: db
      MasterUsername: db
      MasterUserPassword: 123a
      MultiAZ: false
  DBEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Open database for access
      SecurityGroupIngress:
        - IpProtocol: tcp
      FromPort: "3306"
      ToPort: "3306"
      SourceSecurityGroupName:
        Ref: webserver

I have tried my best solving the error. The rds template is taken from https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/quickref-rds.html.

1
amazon-web-servicesamazon-ec2amazon-cloudformationamazon-rdsamazon-vpc
What is your error? – Chris Williams
The following resource(s) failed to create: [DBEC2SecurityGroup, SubnetB, ListS3BucketsInstanceProfile, SubnetA, ListS3BucketsPolicy, VPCGatewayAttachment]. . Rollback requested by user. – user13683097
@wahaj that's not the actual error. look at the resources tab – jordanm
@wahaj this has required a bit of work, believe i now have a working template. Just testing out – Chris Williams
@ChrisWilliams Thanks Chris, I am waiting for your response.I really appreciate it !! – user13683097

1 Answers

0
votes

Below is a fixed template

---
AWSTemplateFormatVersion: 2010-09-09
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 11.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default
  InternetGateway:
    Type: AWS::EC2::InternetGateway
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  SubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2a
      VpcId: !Ref VPC
      CidrBlock: 11.0.1.0/24
      MapPublicIpOnLaunch: true
  SubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: us-east-2b
      VpcId: !Ref VPC
      CidrBlock: 11.0.0.0/24
      MapPublicIpOnLaunch: false
  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  InternetRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
      RouteTableId: !Ref RouteTable
  SubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetA
  SubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref SubnetB
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: "Internet Group"
      GroupDescription: "SSH traffic in, all traffic out."
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: "22"
          ToPort: "22"
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
  webserver:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: webserver
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
          Description: For traffic from Internet
      GroupDescription: Security Group for demo server
      VpcId: !Ref VPC
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: us-east-2a
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            DeleteOnTermination: "true"
            VolumeSize: "8"
            VolumeType: gp2
      ImageId: ami-0bdcc6c05dec346bf
      InstanceType: t2.micro
      KeyName: (webserver)
      NetworkInterfaces:
        - Description: Primary network interface
          DeviceIndex: 0
          SubnetId: !Ref SubnetA
          GroupSet:
            - Ref: webserver
  ListS3BucketsInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: "/"
      Roles:
        - Ref: S3FullAccess
  ListS3BucketsPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: ListS3BucketsPolicy
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:List*
            Resource: "*"
      Roles:
        - Ref: S3FullAccess
  S3FullAccess:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: "/"
  MyDB:
    Type: AWS::RDS::DBInstance
    DependsOn: myDBSubnetGroup
    Properties:
      VPCSecurityGroups:
        - !Ref DBEC2SecurityGroup
      AllocatedStorage: "5"
      DBInstanceClass: db.t2.micro
      Engine: MySQL
      EngineVersion: "5.7.22"
      DBName: db
      MasterUsername: db
      MasterUserPassword: 123a
      MultiAZ: false
      DBSubnetGroupName: MySubnetGroup
  myDBSubnetGroup: 
    Properties:
      DBSubnetGroupName: MySubnetGroup
      DBSubnetGroupDescription: subnet group
      SubnetIds: 
        - !Ref SubnetA
        - !Ref SubnetB
    Type: "AWS::RDS::DBSubnetGroup"
  DBEC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Open database for access
      VpcId: !Ref VPC
      SecurityGroupIngress:
          - IpProtocol: tcp
            FromPort: 3306
            ToPort: 3306
            SourceSecurityGroupId: !Ref webserver

There were multiple issues with the template, below are some tips:

  • With YAML ensure syntax is correct especially when using lists to ensure that they are nested under the correct attribute.
  • Ensure that if a resource should be in a specific VPC you specify.
  • RDS instances require a DB subnet group, with at least 2 subnets across 2 availability zones.
  • Security groups and resources must exist in the same VPC.
  • Use VPCSecurityGroup rather than DBSecurityGroups for an RDS instance.