本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# 使用 CloudFormation 來設定 Amazon VPC 資源
本節提供使用 CloudFormation 設定 Amazon VPC 資源的範例。VPC 可讓您在 內建立虛擬網路 AWS，而這些程式碼片段會示範如何設定 VPCs 的各個層面，以符合您的聯網需求。
**Topics**
+ [在 VPC 中啟用僅限 IPv6 傳入網際網路存取](#quickref-ec2-route-egressonlyinternetgateway)
+ [彈性網路介面 (ENI) 範本程式碼片段](#cfn-template-snippets-eni)
## 在 VPC 中啟用僅限 IPv6 傳入網際網路存取
僅限傳入網際網路閘道允許 VPC 內的執行個體存取網際網路，並阻止網際網路上的資源與執行個體通訊。下列程式碼片段會從 VPC 內啟用僅限 IPv6 傳入網際網路存取。它會使用 [AWS::EC2::VPC](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-vpc.html) 資源建立具有 `10.0.0/16` IPv4 地址範圍的 VPC。使用 [AWS::EC2::RouteTable](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-routetable.html) 資源，將路由表與此 VPC 資源建立關聯。路由表會管理 VPC 內執行個體的路由。[AWS::EC2::EgressOnlyInternetGateway](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-egressonlyinternetgateway.html) 用於建立僅限傳入網際網路閘道，以針對 VPC 內執行個體的傳出流量啟用 IPv6 通訊，同時阻止傳入流量。指定 [AWS::EC2::Route](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-route.html) 資源在路由表中建立 IPv6 路由，這會將所有傳出 IPv6 流量 (`::/0`) 引導至僅限傳入網際網路閘道。
如需僅限傳出網際網路閘道的詳細資訊，請參閱 *Amazon VPC 使用者指南*中[使用僅限傳出網際網路閘道啟用傳出 IPv6 流量](https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html)。
### JSON
```
"DefaultIpv6Route": {
"Type": "AWS::EC2::Route",
"Properties": {
"DestinationIpv6CidrBlock": "::/0",
"EgressOnlyInternetGatewayId": {
"Ref": "EgressOnlyInternetGateway"
},
"RouteTableId": {
"Ref": "RouteTable"
}
}
},
"EgressOnlyInternetGateway": {
"Type": "AWS::EC2::EgressOnlyInternetGateway",
"Properties": {
"VpcId": {
"Ref": "VPC"
}
}
},
"RouteTable": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPC"
}
}
},
"VPC": {
"Type": "AWS::EC2::VPC",
"Properties": {
"CidrBlock": "10.0.0.0/16"
}
}
```
### YAML
```
DefaultIpv6Route:
Type: AWS::EC2::Route
Properties:
DestinationIpv6CidrBlock: "::/0"
EgressOnlyInternetGatewayId:
Ref: "EgressOnlyInternetGateway"
RouteTableId:
Ref: "RouteTable"
EgressOnlyInternetGateway:
Type: AWS::EC2::EgressOnlyInternetGateway
Properties:
VpcId:
Ref: "VPC"
RouteTable:
Type: AWS::EC2::RouteTable
Properties:
VpcId:
Ref: "VPC"
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: "10.0.0.0/16"
```
## 彈性網路介面 (ENI) 範本程式碼片段
### 使用附接的彈性網絡介面 (ENI) 建立 Amazon EC2 執行個體
下列範例程式碼片段會使用 Amazon VPC 和子網路中指定的 [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) 資源建立 Amazon EC2 執行個體。它會將兩個網路介面 (ENI) 附接至執行個體，透過附接的 ENI 將彈性 IP 地址與執行個體建立關聯，以及設定安全群組進行 SSH 和 HTTP 存取。建立執行個體時，會將使用者資料做為啟動組態的一部分提供給執行個體。使用者資料包括以 `base64` 格式編碼的指令碼，以確保將其傳遞至執行個體。啟動執行個體後，指令碼會在引導程序中自動執行。它會安裝 `ec2-net-utils`、設定網路介面，以及啟動 HTTP 服務。
若要根據選取的區域確定適當的 Amazon Machine Image (AMI)，程式碼片段會使用可在 `RegionMap` 映射中查詢值的 `Fn::FindInMap` 函數。此映射必須在較大的範本中定義。使用 [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-networkinterface.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-networkinterface.html) 資源建立兩個網路介面。使用配置給 `vpc` 網域的 [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eip.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eip.html) 資源指定彈性 IP 位址。這些彈性 IP 位址與使用 [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-eipassociation.html) 資源的網路介面相關聯。
`Outputs` 區段定義您想要在建立堆疊之後存取的值或資源。在此程式碼片段中，定義的輸出為 `InstancePublicIp`，代表堆疊建立的 EC2 執行個體的公有 IP 地址。您可以在 CloudFormation 主控台的**輸出**索引標籤中擷取此輸出，或使用 [describe-stacks](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stacks.html) 命令。
如需彈性網路介面的詳細資訊，請參閱[彈性網路介面](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html)。
#### JSON
```
"Resources": {
"ControlPortAddress": {
"Type": "AWS::EC2::EIP",
"Properties": {
"Domain": "vpc"
}
},
"AssociateControlPort": {
"Type": "AWS::EC2::EIPAssociation",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"ControlPortAddress",
"AllocationId"
]
},
"NetworkInterfaceId": {
"Ref": "controlXface"
}
}
},
"WebPortAddress": {
"Type": "AWS::EC2::EIP",
"Properties": {
"Domain": "vpc"
}
},
"AssociateWebPort": {
"Type": "AWS::EC2::EIPAssociation",
"Properties": {
"AllocationId": {
"Fn::GetAtt": [
"WebPortAddress",
"AllocationId"
]
},
"NetworkInterfaceId": {
"Ref": "webXface"
}
}
},
"SSHSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "VpcId"
},
"GroupDescription": "Enable SSH access via port 22",
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"FromPort": 22,
"IpProtocol": "tcp",
"ToPort": 22
}
]
}
},
"WebSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "VpcId"
},
"GroupDescription": "Enable HTTP access via user-defined port",
"SecurityGroupIngress": [
{
"CidrIp": "0.0.0.0/0",
"FromPort": 80,
"IpProtocol": "tcp",
"ToPort": 80
}
]
}
},
"controlXface": {
"Type": "AWS::EC2::NetworkInterface",
"Properties": {
"SubnetId": {
"Ref": "SubnetId"
},
"Description": "Interface for controlling traffic such as SSH",
"GroupSet": [
{
"Fn::GetAtt": [
"SSHSecurityGroup",
"GroupId"
]
}
],
"SourceDestCheck": true,
"Tags": [
{
"Key": "Network",
"Value": "Control"
}
]
}
},
"webXface": {
"Type": "AWS::EC2::NetworkInterface",
"Properties": {
"SubnetId": {
"Ref": "SubnetId"
},
"Description": "Interface for web traffic",
"GroupSet": [
{
"Fn::GetAtt": [
"WebSecurityGroup",
"GroupId"
]
}
],
"SourceDestCheck": true,
"Tags": [
{
"Key": "Network",
"Value": "Web"
}
]
}
},
"Ec2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
"ImageId": {
"Fn::FindInMap": [
"RegionMap",
{
"Ref": "AWS::Region"
},
"AMI"
]
},
"KeyName": {
"Ref": "KeyName"
},
"NetworkInterfaces": [
{
"NetworkInterfaceId": {
"Ref": "controlXface"
},
"DeviceIndex": "0"
},
{
"NetworkInterfaceId": {
"Ref": "webXface"
},
"DeviceIndex": "1"
}
],
"Tags": [
{
"Key": "Role",
"Value": "Test Instance"
}
],
"UserData": {
"Fn::Base64": {
"Fn::Sub": "#!/bin/bash -xe\nyum install ec2-net-utils -y\nec2ifup eth1\nservice httpd start\n"
}
}
}
}
},
"Outputs": {
"InstancePublicIp": {
"Description": "Public IP Address of the EC2 Instance",
"Value": {
"Fn::GetAtt": [
"Ec2Instance",
"PublicIp"
]
}
}
}
```
#### YAML
```
Resources:
ControlPortAddress:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
AssociateControlPort:
Type: AWS::EC2::EIPAssociation
Properties:
AllocationId:
Fn::GetAtt:
- ControlPortAddress
- AllocationId
NetworkInterfaceId:
Ref: controlXface
WebPortAddress:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
AssociateWebPort:
Type: AWS::EC2::EIPAssociation
Properties:
AllocationId:
Fn::GetAtt:
- WebPortAddress
- AllocationId
NetworkInterfaceId:
Ref: webXface
SSHSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VpcId
GroupDescription: Enable SSH access via port 22
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
FromPort: 22
IpProtocol: tcp
ToPort: 22
WebSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId:
Ref: VpcId
GroupDescription: Enable HTTP access via user-defined port
SecurityGroupIngress:
- CidrIp: 0.0.0.0/0
FromPort: 80
IpProtocol: tcp
ToPort: 80
controlXface:
Type: AWS::EC2::NetworkInterface
Properties:
SubnetId:
Ref: SubnetId
Description: Interface for controlling traffic such as SSH
GroupSet:
- Fn::GetAtt:
- SSHSecurityGroup
- GroupId
SourceDestCheck: true
Tags:
- Key: Network
Value: Control
webXface:
Type: AWS::EC2::NetworkInterface
Properties:
SubnetId:
Ref: SubnetId
Description: Interface for web traffic
GroupSet:
- Fn::GetAtt:
- WebSecurityGroup
- GroupId
SourceDestCheck: true
Tags:
- Key: Network
Value: Web
Ec2Instance:
Type: AWS::EC2::Instance
Properties:
ImageId:
Fn::FindInMap:
- RegionMap
- Ref: AWS::Region
- AMI
KeyName:
Ref: KeyName
NetworkInterfaces:
- NetworkInterfaceId:
Ref: controlXface
DeviceIndex: "0"
- NetworkInterfaceId:
Ref: webXface
DeviceIndex: "1"
Tags:
- Key: Role
Value: Test Instance
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
yum install ec2-net-utils -y
ec2ifup eth1
service httpd start
Outputs:
InstancePublicIp:
Description: Public IP Address of the EC2 Instance
Value:
Fn::GetAtt:
- Ec2Instance
- PublicIp
```