问题描述
我正在尝试在 Cloudformation 中为 API 网关创建 VPC 端点,但收到此错误:
Endpoint type (Gateway) does not match available service types ([Interface]).
下面的模板放在资源部分:
executeApiEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: "*"
Action:
- "execute-api:Invoke"
- "execute-api:ManageConnections"
Resource:
- "arn:aws:execute-api:*:*:*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
VpcId: !Ref pubPrivateVPC
这个也不行:
executeApiEndpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal: "*"
Action:
- "execute-api:*"
Resource:
- "*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.execute-api
VpcId: !Ref pubPrivateVPC
然而,这个块(来自模板)能够在没有任何错误的情况下执行:
s3Endpoint:
Type: AWS::EC2::VPCEndpoint
Properties:
PolicyDocument:
Version: 2012-10-17
Statement:
- Effect: Allow
Principal: "*"
Action:
- "s3:*"
Resource:
- "*"
RouteTableIds:
- !Ref privateRouteTable
ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
VpcId: !Ref pubPrivateVPC
这里出了什么问题?
解决方法
您还必须将 AWS::EC2::VPCEndpoint
资源上的 VpcEndpointType property 指定为 Interface
才能使接口类型 VPC 端点正常工作。默认为“网关”,仅适用于 S3 和 DynamoDB VPC 端点。
您的解决方案使用 S3 作为端点的原因是因为 VpcEndpointType
属性将“网关”作为默认值(适用于 S3)。