资源处理程序返回消息：“提供的请求无效：网络负载均衡器侦听器不支持规则

Posted

技术标签:

【中文标题】资源处理程序返回消息：“提供的请求无效：网络负载均衡器侦听器不支持规则【英文标题】：Resource handler returned message: "Invalid request provided: Rules are unsupported for Network Load Balancer listeners 【发布时间】：2021-11-26 18:38:27 【问题描述】：

我正在为 ECS 自动化创建 CloudFormation 堆栈，并且正在使用内部 NLB。

我遇到了 ListenerRule 问题，它在 CloudFormation 中返回以下错误：

我的脚本是这样的：

AWSTemplateFormatVersion: 2010-09-09

Description: ECS Fargate

Parameters:

  Name:
    Type: String
  
  VPC:
    Type: AWS::EC2::VPC::Id

  Subnets:
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup::Id 

  CreationVCPEndpoint:
    Type: String
    AllowedValues: [true, false]

  DesiredCount:
    Type: String

Conditions:
  CreationVCPEndpointSelected: !Equals [!Ref CreationVCPEndpoint, true]

Resources:

# Endpoints necessários para o serviço do ECS funcionar.

  EndpointLogs:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .logs
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointS3:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointECR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.api
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointSSM:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointDKR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.dkr
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

# Criação do NLB Privado

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref Name
      Subnets: !Ref Subnets
      Type: network
      Scheme: internal
      Tags:
        - Key: Name
          Value: !Ref Name

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub $Name-tg
      VpcId: !Ref VPC
      Port: 80
      Protocol: TCP
      TargetType: ip

  ListenerRule:
    Type: AWS::ElasticLoadBalancingV2::ListenerRule
    Properties:
      ListenerArn: !Ref LoadBalancerListener
      Priority: 1
      Conditions:
        - Field: source-ip
          #Values:
          #  - /
      Actions:
        - TargetGroupArn: !Ref TargetGroup
          Type: forward

# Criação da IAM para o ECS

  ECSIAM:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: !Ref Name
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action: "*"
                Resource: "*"

# Criação do ECS Fargate

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Ref Name

  ECSService:
    Type: AWS::ECS::Service
    DependsOn: ListenerRule
    Properties:
      Cluster: !Ref ECSCluster
      Role: !Ref ECSIAM
      DesiredCount: !Ref DesiredCount
      TaskDefinition: !Ref ECSTaskDefinition
      LoadBalancers:
        - ContainerName: "website-service"
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup

  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: website-service
      NetworkMode: awsvpc
      ContainerDefinitions:
        - Name: website-service
          Essential: true
          Image: 489732776903.dkr.ecr.us-west-2.amazonaws.com/daniel:latest
          Memory: 128
          #Environment:
          #  - Name: PRODUCT_SERVICE_URL
          #    Value: !Ref ProductServiceUrl
          PortMappings:
            - ContainerPort: 80
          #LogConfiguration:
          #  LogDriver: awslogs
          #  Options:
          #    awslogs-group: !Ref CloudWatchLogsGroup
          #    awslogs-region: !Ref AWS::Region

有人知道正确的 ListenerRule 配置是什么吗？

【问题讨论】：

完全移除 ListenerRule。 NLB不能做7层路由，只能使用默认动作。 @jordanm 我从 ECSService 中删除了 ListenerRule 和 DependsOn 并返回此错误：资源处理程序返回消息：“提供的请求无效：CreateService 错误：使用 targetGroupArn arn:aws:elasticloadbalancing:us-west- 的目标组2:[myaccount]:targetgroup/teste-tg/1bbab9617a9dab6f 没有关联的负载均衡器。（服务：AmazonECS；状态代码：400；错误代码：InvalidParameterException；请求 ID：ede2cb41-288e-4dc2-b8ea-834ee95f61ba；代理: null)" (RequestToken: c1cc36ec-cba6-e47e-fb8d-b269f259e439, HandlerErrorCode: InvalidRequest) 【参考方案1】：

我设法得到了正确的模板，模板已经准备好了。

AWSTemplateFormatVersion: 2010-09-09

Description: ECS Fargate

Parameters:

  Name:
    Type: String
  
  VPC:
    Type: AWS::EC2::VPC::Id

  Subnets:
    Type: List<AWS::EC2::Subnet::Id>

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup::Id 

  CreationVCPEndpoint:
    Type: String
    AllowedValues: [true, false]

  DesiredCount:
    Type: String

Conditions:
  CreationVCPEndpointSelected: !Equals [!Ref CreationVCPEndpoint, true]

Resources:

# Endpoints necessários para o serviço do ECS funcionar.

  EndpointLogs:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .logs
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointS3:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .s3
      PrivateDnsEnabled: false
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointECR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.api
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointSSM:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ssm
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

  EndpointDKR:
    Type: AWS::EC2::VPCEndpoint
    Condition: CreationVCPEndpointSelected
    Properties:
      ServiceName: !Join
        - ''
        - - com.amazonaws.
          - !Ref 'AWS::Region'
          - .ecr.dkr
      PrivateDnsEnabled: true
      SecurityGroupIds: 
        - !Ref SecurityGroup
      SubnetIds: 
        Ref: Subnets
      VpcEndpointType: Interface
      VpcId: 
        Ref: VPC

# Criação do NLB Privado

  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Ref Name
      Subnets: !Ref Subnets
      Type: network
      Scheme: internal
      Tags:
        - Key: Name
          Value: !Ref Name

  LoadBalancerListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: TCP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub $Name-tg
      VpcId: !Ref VPC
      Port: 80
      Protocol: TCP
      TargetType: ip

# Criação da IAM para o ECS

  ECSIAM:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          -
            Effect: "Allow"
            Principal:
              Service:
                - "ecs.amazonaws.com"
                - "ecs-tasks.amazonaws.com"
            Action:
              - "sts:AssumeRole"
      Path: "/"
      Policies:
        -
          PolicyName: !Ref Name
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              -
                Effect: "Allow"
                Action: "*"
                Resource: "*"

# Criação do ECS Fargate

  ECSCluster:
    Type: AWS::ECS::Cluster
    Properties:
      ClusterName: !Ref Name

  ECSService:
    Type: AWS::ECS::Service
    DependsOn: LoadBalancerListener
    Properties:
      Cluster: !Ref ECSCluster
      LaunchType: FARGATE
      DesiredCount: !Ref DesiredCount
      TaskDefinition: !Ref ECSTaskDefinition
      NetworkConfiguration:
        AwsvpcConfiguration:
          AssignPublicIp: ENABLED
          SecurityGroups:
            - sg-0c2e8f8e84a22bdd4
          Subnets:
            - subnet-04d79b3e4ac16ba6f
            - subnet-07baab102179ee184
      LoadBalancers:
        - ContainerName: "test-container"
          ContainerPort: 80
          TargetGroupArn: !Ref TargetGroup

  ECSTaskDefinition:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: test-container
      NetworkMode: awsvpc
      Cpu: 512
      Memory: 1024
      ExecutionRoleArn: !Ref ECSIAM
      RequiresCompatibilities:
        - FARGATE
      ContainerDefinitions:
        - Name: test-container
          Essential: true
          Image: URI
          Cpu: 512
          Memory: 1024
          PortMappings:
            - ContainerPort: 80

【讨论】：

以上是关于资源处理程序返回消息：“提供的请求无效：网络负载均衡器侦听器不支持规则的主要内容，如果未能解决你的问题，请参考以下文章

AWS Lambda 无服务器资源处理程序返回消息：“解压缩后的大小必须小于 262144000 字节

多线程中同步和异步？

消息处理程序 INT_PTR 返回值的目的是啥？

好程序员Java学习资源分享RabbitMQ介绍

什么是线程同步，什么是线程异步？同步的好处与弊端

ASP.NET 4.5 Web API 2.0，JWT 消息处理程序将状态 0 返回到 Angular 7 HTTP 拦截器