无法通过CFN-init和的UserData脚本部署使用AWS CloudFormation模板上EC2实例应用程序

Question

我想在推出的时间上部署的EC2实例sample.war应用。当一个实例启动的应用程序应自动使用CFN-init和元数据上部署的。我加入的政策和认证，没有运气的用户。如果我与S3路径wget的，该文件被下载。下面是我的脚本。我缺少这个，或者是有任何其他方式做到这一点？

---
AWSTemplateFormatVersion: 2010-09-09
Description: Test QA Template
Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMIIdParam
      InstanceType: !Ref InstanceType
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              java-1.8.0-openjdk.x86_64: []
              tomcat: []
              httpd.x86_64: []
          services:
            sysvinit:
              httpd:
                enabled: true
                ensureRunning: true
          files:
            /usr/share/tomcat/webapps/sample.zip:
              source: https://s3.amazonaws.com/mybucket/sample.zip
              mode: '000500'
              owner: tomcat
              group: tomcat
              authentication: S3AccessCreds
      AWS::CloudFormation::Authentication:
        S3AccessCreds:
          type: 'S3'
          accessKeyId: !Ref HostKeys
          secretKey: Fn::GetAtt:
            - HostKeys
            - SecretAccessKey
          buckets: !Ref BucketName
  CfnUser:
    Type: AWS::IAM::User
    Properties:
      Path: '/'
      Policies:
        - PolicyName: 'S3Access'
          PolicyDocument:
           Statement:
             - Effect: 'Allow'
               Action: s3:*
               Resource: '*'
  HostKeys:
    Type: AWS::IAM::AccessKey
    Properties:
      UserName: !Ref CfnUser

Answer 1

我无法重现此使用以下模板：

---
AWSTemplateFormatVersion: 2010-09-09
Description: Test QA Template
Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-08589eca6dcc9b39c
      InstanceType: t2.micro
      KeyName: default
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          /opt/aws/bin/cfn-init -s ${AWS::StackId} --resource MyInstance --region ${AWS::Region}
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages:
            yum:
              java-1.8.0-openjdk.x86_64: []
              tomcat: []
              httpd.x86_64: []
          services:
            sysvinit:
              httpd:
                enabled: true
                ensureRunning: true
          files:
            /usr/share/tomcat/webapps/sample.zip:
              source: https://s3.amazonaws.com/mybucket/sample.zip
              mode: '000500'
              owner: tomcat
              group: tomcat

（换句话说，使用上面的模板允许我使用CFN-初始化安装sample.zip文件。）

因此，有一些权限相关的在您所访问的S3存储的方式。

我只想说，这是一个不好的做法，使用访问键。看看this文件上分配一个IAM角色，以EC2实例，然后补充说，授予该角色相应的访问权限的桶政策的最佳做法。